General
- Target 2026-07-30_2c5394c295a0783c4e61230c493e5959_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader_wapomi
- Size 1.0MB
- Sample260730-js8egafj91
- SHA256 eb463864cb3e22603ad9bd4fda22533dd611760a91fd36607dd1963ab7a832fa
- MD5 2c5394c295a0783c4e61230c493e5959
- SHA1 b19748461f21ec68b0400472a3379e70a30982b5
- SHA512 514c0af6023da9adba3c92321a7a41ff6c6c889d3af21cc35c417edfaa93b2e20ce26d1e8ea59e9f691301c10f135b8f0cedd01542438a2c1ff772a03436c752
- SSDEEP 24576:RfoM0Y7ScPlZ0aNZUZboX+sZTTXbdbhw:N/NyAZUZEPTTrdq
- TLSH T179358C217442C43BE2B151B1C468FBFC856E7E24CB2681D3A3E43E6B79346D26E35672
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_2c5394c295a0783c4e61230c493e5959_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader_wapomi.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Malware Config
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Targets
-
- Target 2026-07-30_2c5394c295a0783c4e61230c493e5959_amadey_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader_wapomi
- Size 1.0MB
- SHA256 eb463864cb3e22603ad9bd4fda22533dd611760a91fd36607dd1963ab7a832fa
- MD5 2c5394c295a0783c4e61230c493e5959
- SHA1 b19748461f21ec68b0400472a3379e70a30982b5
- SHA512 514c0af6023da9adba3c92321a7a41ff6c6c889d3af21cc35c417edfaa93b2e20ce26d1e8ea59e9f691301c10f135b8f0cedd01542438a2c1ff772a03436c752
- SSDEEP 24576:RfoM0Y7ScPlZ0aNZUZboX+sZTTXbdbhw:N/NyAZUZEPTTrdq
- TLSH T179358C217442C43BE2B151B1C468FBFC856E7E24CB2681D3A3E43E6B79346D26E35672
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Bdaejec Backdoor.
Bdaejec is backdoor written in C++.
-
Detects executables packed with ASPack
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE