Extracted

• • Target
    2026-07-06_78561fb5031483e26a251cc757c4a1fb_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil_smoke-loader_wapomi
  • Size 13.1MB
  • SHA256 9a92cafce2a0c6fb77d28462b494bea531363b2fedf9309dfeb7a0e76935c903
  • MD5 78561fb5031483e26a251cc757c4a1fb
  • SHA1 201affec5d96ce7863f736760bb8d4d6f036718f
  • SHA512 61f5b18a23fbfb09da6927ddd7ac50e3c2b2b663ae3afcc18a688550ed9403d78a64844a0b9cc80d920f28dd23354b6176df6e8f8bfb7b2e85c0829005d03699
  • SSDEEP 196608:KcoEAtLe2HnsU2mybWchzHzJsv6tWKFdu9CVBf:KcY9e1UsPhzHzJsv6tWKFdu9CX
  • TLSH
    T134D6AFD3F38380B2F5811176516AE7774A34BE150B1595D7F3D83E6A99302E23E3B28A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoverybdaejecadwarepersistencespyware

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2