Extracted

• • Target

    2024-12-21_e25dad8709bfd24b7b6d6d1f4fa08cad_smoke-loader_vidar_wapomi

  • Size

    340KB

  • MD5

    e25dad8709bfd24b7b6d6d1f4fa08cad

  • SHA1

    756ef7d1b46058a8f9a0ac970d70a6b99ad7f714

  • SHA256

    f3a03b31eab9cfe7b1fb24cabcd6636a4e6a6d4305933673f79c0c3057d5e1c2

  • SHA512

    5b4ad8516344a93a417675f02b15b9a809362253515ec97549b1e82b99c339957ebbfd122cbca92ff0164fb926c7549b490443e0ae37c56208f186f7a576f8f0

  • SSDEEP

    6144:NJNZY5Qyj72EDV60+Al55WmYkIcMWgwwBehAt1qh:PP4n2yDBYkIYwBeA

  Score

  10^/10

  bdaejecaspackv2backdoordiscoveryspywarestealer

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2