Extracted

• • Target
    2026-08-02_652008b22ea74e61eb02e5c4f4120310_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi
  • Size 5.8MB
  • SHA256 17dd54273acc8b12b9a9c53539fb8212cc5747e026eb2623ae14744b841841c7
  • MD5 652008b22ea74e61eb02e5c4f4120310
  • SHA1 a9e83b6ff3e6042dd4a1a36c4b3e69cc7d8f3a12
  • SHA512 f92b33ccd6e44afcaa2a9cef26214e6e44d4e61d571996cc7eeec842c7432c0d2fecf0f3b1de95fbe11a2ccf38ad8f6ffce1fb30ead8e4a3834791e34f562131
  • SSDEEP 98304:r+/mEfM78Z4CfoCCPaP4Vhc18frP3wbzWFimaI7dloOY:J01Z47V7gbzWFimaI7dlRY
  • TLSH
    T15F569E51BF8C817AC95A1531072DAF2A402ABC98773465D3B2743E7EEC753C26C3A61B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareaspackv2backdoordefense_evasiondiscoveryexecutionbdaejecpersistencephishingspywarestealertrojan

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables packed with ASPack

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  behavioral1behavioral2