Extracted

• • Target
    2026-06-26_c037d923750e0064120d1c111e36406f_derusbi_elex_nitol_smoke-loader_wapomi
  • Size 856KB
  • SHA256 ea549be8df26935101dc303a95bd5b679b93b45b5ca126622514c2287766a462
  • MD5 c037d923750e0064120d1c111e36406f
  • SHA1 bb519331b8f66ee0e9efbae4a762f71598619dce
  • SHA512 496c408f6c63ceec761d0dabfe395cdebcaf2c8d26d56492eccb654dcab75b24468231e775b4d232c9d7d632abd3c372c3a9b1f19e1ffcd3d9c217bec708321b
  • SSDEEP 24576:A/x4LKOI24F6cElE0X0xPOpmTCDe3eQPI0:8xzOVmPxk4PI
  • TLSH
    T1ED1523F9CB2226ABC9AB1636D1F691567B74FE3040B0003769DE3B89559E201DF7D8B0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordefense_evasiondiscoverybdaejecpersistence

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2