Extracted

• • Target

    2025-01-29_fd5152c90190eb2905a4843bba0f0203_smoke-loader_wapomi

  • Size

    4.5MB

  • MD5

    fd5152c90190eb2905a4843bba0f0203

  • SHA1

    c054c6371e39785df6ffd19603c7b33c4abc9664

  • SHA256

    545aa463a18bdd6dc65a3fe14c5c274c778ce428498f6f9eb4efef78faf213d3

  • SHA512

    1f174cc1c509a499bdaff9d697d800633b51d81abe81c12f4589401c5f80ff89b05caa80baac8361252d7d44aafed99c40e38ab11404c6a1379e8171fac82cfd

  • SSDEEP

    98304:+9Kowl90E9mSBixvXDESNYMnVfgmtghRvUiFrJsWTc:+9Ko9yMnVfgvDvUEs

  Score

  10^/10

  bdaejecaspackv2backdoordefense_evasiondiscoverythemidatrojan

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2