Extracted

• • Target
    2026-06-27_b86d73e894e25c4ee38057cd0f74920c_elex_smoke-loader_wapomi
  • Size 1.5MB
  • SHA256 bc9a0ad8b8de768de78a00e47cb47d6137a132eaa24085f5f70e9e3ab5d742c8
  • MD5 b86d73e894e25c4ee38057cd0f74920c
  • SHA1 e42acb375ccb7a80d2e17bd21493024e2ceb7180
  • SHA512 4fda6ae76fc5f60e00f812242b0cc7e39d820116b5c9d0063c488ba4a631e7cbf2442f077491a28820937fb146a9f3a7dfece826e6407ae3d77a2d06dec8e828
  • SSDEEP 24576:r0uTXIAZiMbn9oRBU5yaygRmGh9oEXGVQ6MjWjnbQU2wCk6BOXcqrBPHLIJAqchr:r0uTfn9M8RmGh9oEXGVQ6MjWjnbYnMqP
  • TLSH
    T12B758C40FB87C1B2DF4201B0196B9B6E416DED04DB216EE7E3980F1E29716E26E3719D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordefense_evasiondiscoverybdaejecadwarepersistenceransomwarespyware

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2