Extracted

• • Target
    2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi
  • Size 19.9MB
  • SHA256 73bf39628f058b73e30528f4d03c4380d6f9f7644d566db65aada296d04c857f
  • MD5 701452bcaa689252fac2fb77435723f9
  • SHA1 2228aa681411fc06eb4f454026056cc285c13997
  • SHA512 358f715dc3598f0dbc285700d354b99a420bf140d690c49e3f9be46554f23394bebfe4ef0b89dfcd0f83dc5b8e13fac5f2d80b4e52a089d8b776dc7e15741d19
  • SSDEEP 393216:A26TmZAFlRXesKCH9+oOrHpmpU9Y+c8EDW8xVmBWHf67C:naHRukBOr+mAK8VmU6+
  • TLSH
    T1E62733AD0FD648EED4C11CB89B276BE713F592E6489E4C35AAC0744570B1FF1B01E2A6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoorbootkitdefense_evasiondiscoveryexecutionbdaejecpersistencetrojan

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2