Extracted

• • Target
    2026-07-06_7f8721f66f7cd03a676db93176fbb0a7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader_wapomi
  • Size 163KB
  • SHA256 b7d7f5dfcece1443ed75b1346cfb49f60edb8c5ceac23fde536e63c346f9a6fc
  • MD5 7f8721f66f7cd03a676db93176fbb0a7
  • SHA1 47bb321fbca4272d0f458a5cbf8206bb1a50d7ac
  • SHA512 b109c56746da8710282172fb45c130242fb513d286a8ff4bbd7304d8e073ac6d0b3789ac2c0e242b9d1d3d0530c0cb6d14deb4da2a5b7b51832a7972b29a54ce
  • SSDEEP 3072:wy3X2hpUF3+fCtWJXbHoeNK9g8lB6ymCYTvHsgHiOWGstQUueRh5qrS9jaDGCH:lW8mIwnoUyQjMFGEueRc6
  • TLSH
    T19DF3AE25B0C1C072C876283501F4D3B1EE7DBA302F656ADFA3855B396F312D2A62597B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoverybdaejecadwarepersistencespyware

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2