Extracted

• • Target
    2026-06-26_2c3fa5b8d4396771dae62f196a3ac744_elex_glassworm_smoke-loader_wapomi
  • Size 32.8MB
  • SHA256 3c955dab0b5fb59499268b0c56bec9dd5342d340ecf28648e6f5c098e467ac55
  • MD5 2c3fa5b8d4396771dae62f196a3ac744
  • SHA1 c6c4c8ce6b1d48b2cb628edf9c60e4069afae900
  • SHA512 89c2bbe1ffb61c57ae1c4dd49c3ef2a185a10e29f5c89707ef8fbde15b6afec028a9c3e18f7ef2db85cb50823643c5943b0296e18ffbee3cf3f95066e7d7f2e6
  • SSDEEP 393216:Ohu1fCryDVdqRszxxm9C3m7ktnhF4uJwFo4wso+XwwvZhhUp+AF+/K:tNCryWIxm9EtR36XwaaqK
  • TLSH
    T169777B82EA8791F2E8470D70416BF77F6B346A05C020CE76EED87B56FA73B91150A709
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoverybdaejecadwarepersistencespyware

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2