Extracted

• • Target
    2026-08-03_94d52dd82191a61ee001b4723294b0a8_elex_smoke-loader_wapomi
  • Size 24.9MB
  • SHA256 253c5d89b1c3edd1cd886d85c4bbf8f3648c009885b340800a2de1a4fea2525c
  • MD5 94d52dd82191a61ee001b4723294b0a8
  • SHA1 b525d08fb3d4633c94f725ac2d2af2d97cce95b2
  • SHA512 9fe23412155e402139082b05c1490b4b6a91b6e27fea78d52aae1d80497c69561d1655fc43eb87855704aca47794ae2f574626fdf579ad0668fa79942c67057b
  • SSDEEP 393216:7LqsB3VDk5Pz7p7n3yHYwu/yy0dLVifpBgXAUVIdHzgzhGbjyAeaRYfruHd:7AFn3y4wu/f0d5SpBgXAX0znAy2
  • TLSH
    T17A47331B589D095ECDE39AF0BD6F5D4FD6A91F050603C0A8BC9B3B05A633AD4EB421D2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordefense_evasiondiscoveryexecutionbdaejectrojan

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2