Extracted

• • Target
    2026-08-02_8d3f09233195a258f9f034ddab977c4d_elex_smoke-loader_wapomi
  • Size 10.9MB
  • SHA256 264ec677f30b335d2af340ad6042720da668a38364ea1c22a47034db13e694cf
  • MD5 8d3f09233195a258f9f034ddab977c4d
  • SHA1 ea5d1600c8f56246f13cdaa4813a489e57c48895
  • SHA512 f4659fe12269edbdb2777b4dc1b90af371f0582e1a95455f9b7360164c39ce27f683e4d489cb1e9fcb17d281c193bd203513c536336492b3db6bb1b1c162593d
  • SSDEEP 196608:vCMEaB2y6zrzMPMYQdaU+t7NX6zvq+eDuPObFYD3/qXbtT8xf0K:vCMoyErzKJGw1NX6z1DP8FuyXlM0K
  • TLSH
    T1AAB633A50478A7ABC48F72F8278DE045DAD8FF8660C2025254B6B3B62F37293ED5517C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoveryexecutionbdaejecupx

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2