Extracted

• • Target
    2026-07-02_249814a9f54a7db0f6c00ef1e768b4b0_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi
  • Size 96KB
  • SHA256 fd6cf055b35277e150308299612fff17112581b647efc36036d4913310ea58ab
  • MD5 249814a9f54a7db0f6c00ef1e768b4b0
  • SHA1 f1f37f0bc18aa5134adb8a14d4c4b281a5050991
  • SHA512 bf5e0b77ec940bf109c25ef4ae1f47d3ea42c9e053b36f8b015af3a2169c51a42799d2ed0d5845cb0ab090ef98e9e576f876ee4384ab0176e52f29e341e7b87f
  • SSDEEP 1536:WBeYPEuHL4zn5GKBZCGCq2iW7zsdKhzlGCq2iW7z:YLsn5GKBEGCHnpGCH
  • TLSH
    T128A37C127AF4C032E0A776790436E252AF7FBE619A78D38F7754256E0E303909E25367
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoverybdaejecadwarepersistenceransomwarespyware

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2