Extracted

• • Target

    2024-12-22_6970b4657293e4980e51dc756dd1bad3_smoke-loader_wapomi

  • Size

    54KB

  • MD5

    6970b4657293e4980e51dc756dd1bad3

  • SHA1

    42cf3bad1f8079c0ceabe7addc45e031ae129f39

  • SHA256

    acd1aa0d197f7eef419d12b309b3a5cdfc094bf300c2f7fc84523ea7e49219c1

  • SHA512

    4c739e30f4d12896dde1ff4f23d70dfd5120b0e77e4a59adce1b36540b0a86065315a383dd76ac7680bf0a17019a3518df70cafc17a8b2edb2b8d1d0f9259390

  • SSDEEP

    768:1ubLj/ur3kdABSJpYkI1+RjBHUZWG4F9UIV2SyYAxIQGPL4vzZq2o9W7GsxBbPr:1AekdABcfjBHCje9UBS5AxDGCq2iW7z

  Score

  10^/10

  bdaejecaspackv2backdoordiscoveryupx

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2