Extracted

• • Target
    2026-07-08_c19af5602a289e06066a9a712a20a948_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat_smoke-loader_wapomi
  • Size 686KB
  • SHA256 15af0c21fdd15ab5bc81712760ff7f64dc777646706afd3e2f2d07017cbb0b79
  • MD5 c19af5602a289e06066a9a712a20a948
  • SHA1 5f16a74bdd99ec9e9294fff416032a40fdb88301
  • SHA512 0bfcedf11bc4a64b4125bd9cebee9cc9946c23e8f6d266574f3d45ddc30442595039f76d9d1e31b51aa6913c2eb1414767b6ef49e71c419d1e5bd57a15ef2e61
  • SSDEEP 12288:Pz14TZYCdvf/WCCr8+bNlz+OeO+OeNhBBhhBBHClpYZjMsYEe1azQ3+04DdibJnr:Pq1fObNlS3OsQaKZSqw7m9dgk
  • TLSH
    T19FE49E31B683D13AC47110F04D7CEB9A642EFD260B655EDBB3C84B3D5A351D21E32A6A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoverybdaejecadwarepersistencespyware

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2