Extracted

• • Target
    2026-07-07_f70e47e4a9016f0f1f7d313dedda5967_elex_nymaim_rhadamanthys_smoke-loader_wapomi
  • Size 48KB
  • SHA256 70075dc41bc455fb97b46ce45c718b55925382ed5f86eb53dd4b54941a0b040f
  • MD5 f70e47e4a9016f0f1f7d313dedda5967
  • SHA1 8ad7e6d84f8eadab0b161d5004ec725be216e42e
  • SHA512 505dd5686ee976a84ef225a3d7139cf312f244c82f00454524e6c97f21ffa403edb53b1b74da357cab631229d57dd5a41c8a18cdd90fb30cfb776c957c096340
  • SSDEEP 768:vcrhjlH1IyaQxVh+jMoXF58QGPL4vzZq2o9W7GsxBbPr:u9dhxLboXF5fGCq2iW7z
  • TLSH
    T13023AEF35CA045B7C4C9A031A0F96B56577B65330671A4DB87904C5F2E32680EC3E7A6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoverybdaejecadwarepersistencespyware

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2