Extracted

• • Target
    2026-05-29_10a7f60d554e34f9a3e144a1c6ef1cd5_amadey_elex_smoke-loader_wapomi
  • Size 4.9MB
  • SHA256 e4eb02ad9e26a2aa9cf935ddd364b6866a40477a468f9175e15cf3c51aa3c5aa
  • MD5 10a7f60d554e34f9a3e144a1c6ef1cd5
  • SHA1 afdf8c828fcbc861aa8c0651f452e62dd5ac8f92
  • SHA512 8889c21fb45a17439d8e7018670d8680e873bd49e78e6fc1389bd490ce1c4f8ba756b4a2499de28f83431b19a9a6620ee0faaa12617aab1162271963d8a82fa0
  • SSDEEP 49152:/eFENBIGQ/lFTjN43Q/lFTjN4hQ/lFTjN4pQ/lFTjN4NQ/lFTjN4GQ/lFTjN4nQS:2FEPYLmcLmGLmeLmCLmRLmMLm
  • TLSH
    T1493623253AA4F47BEB1306718D428782A3FF4BC56FA1574B7B84152CE77C3D442AAB48
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoverybdaejecransomwarespywarestealer

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec
  • Custom signature

    Detects executables packed with ASPack

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2