Extracted

• • Target

    2025-02-16_00738047dd2cb3013e2dd12566ce93c3_smoke-loader_wapomi

  • Size

    16.9MB

  • MD5

    00738047dd2cb3013e2dd12566ce93c3

  • SHA1

    dbb24f50b79b359b171af23e9ae0aed1c5ac1a22

  • SHA256

    f3e36383b1f83f5790f71b05e7a94715d3eba5d71eb357188b0c4c664bd2a16a

  • SHA512

    905069d00c8e6d8dba2718782986d8aa28fb32ee520fd5d6b9acda06ff710f457c9a68058df0971624a32ea41a2a510cf06c49b15ad65b7f3fb566bfc37d1925

  • SSDEEP

    393216:1WZqZmyvWBInlOEGBmo3NA1GQhjzkcfv7tbnF8PM:6qMClOEGBmayjzNH7tzF8k

  Score

  10^/10

  bdaejecaspackv2backdoordiscovery

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Downloads MZ/PE file

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2