Extracted

• • Target
    2026-07-09_4a6f1e946c467b0f4e10ccb510b497af_elex_smoke-loader_wapomi
  • Size 361KB
  • SHA256 39541bcfa0a95c82af0d3060da018e2ad8dc418314e666d1a0a992bc2d478998
  • MD5 4a6f1e946c467b0f4e10ccb510b497af
  • SHA1 16ecf09ea08edfc316930730b7bb58f77d528c01
  • SHA512 b68550e030524cc7cc3fe81858221e0a0af34ef4d2852a2e9bf11c5674413584745798f156196f2f2c7a25637e4e4b0b8901268ac9c8e4890da3327a00498845
  • SSDEEP 6144:EEk40dcUBO+9Om+5+qbRP9w/3niH4HhppPfwOkpuiSpQ1ai/omtrxLw4ZHjms0lo:h91P9wqH4HhppPYO8uiSpQ1ai/oCxLwL
  • TLSH
    T14C747C92FE8291F3E6CA01B891F7AB775D359D25A3109AC3E3D15DB04C216D0A23A3DD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoverybdaejecadwarepersistenceransomwarespyware

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2