Extracted

Extracted

• • Target
    2026-07-22_1258eeb3d67cd2529e3c15a5a34fca43_elex_huhk_smoke-loader_wapomi
  • Size 316KB
  • SHA256 715c703ce360c000ad611760ac24c0750ce507e9f368fec6f65842c203ed4ab8
  • MD5 1258eeb3d67cd2529e3c15a5a34fca43
  • SHA1 8e55e63e1af26f9e401e1d20cb56b84bb6d7e44b
  • SHA512 c33e50f39e9eb64a855ff90afaf97033d6c85ab31dd6dbea96ea2829c137cf344c7a1600a6140288d32a547b0ade9642878ee124743a697c1ad84d1eaa3a51a5
  • SSDEEP 3072:KvTN7q8fUjqkymdzFGCH8bgU33qyL7EdDiQI8sQhu:KZfUmkCFsUHqoAWQIVD
  • TLSH
    T1C5642B43B216A1E4E82CC87A151771F62BCA2C715E0EAD177159BF3738B20E47E1672B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordefense_evasiondiscoveryexecutionbdaejecsalitytrojanupx

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with ASPack

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2