Extracted

• • Target
    2026-07-03_177cf5a979d72f9a416951498f57e9bd_elex_emotet_smoke-loader_wannacry_wapomi
  • Size 1.1MB
  • SHA256 cd217f55a48f1d9ad7e3ef0d7077b8b560e1ecaa31f4177f2158201e1ac59904
  • MD5 177cf5a979d72f9a416951498f57e9bd
  • SHA1 545519653102ced925d6414f796fc086d167db54
  • SHA512 f13bb6fdd28a6f8c7ed57574da04869f568bc825dc1497dcc936a10d4d615d7031638a29d66d5ce930bc0c9fc601b912a858e01c7a5d2137fbbd3225f65e5976
  • SSDEEP 24576:3/m5HfmQjwOFB+f6iMUfdFfEzYH8N4I0i7vXM3+63TXe25G:YfmQjwcUfdFfEM3Y7vX/CTtG
  • TLSH
    T146458C0176EAC278F6B327308976D327063BBD458FB496DF53205E0D69B06D0993A3B6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoverybdaejecadwarepersistenceransomwarespyware

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2