General
- Target 2026-08-05_5222c57eba0c4e580d89a36de9c917e1_amadey_elex_luca-stealer_njrat_smoke-loader_wapomi
- Size 1.5MB
- Sample260805-w8rg4stejb
- SHA256 101acd96b344cd899eb69196a259498544c38077c2e25997747a9284dc83e1ca
- MD5 5222c57eba0c4e580d89a36de9c917e1
- SHA1 ea8ce883a1e6bf3f69fa5e8399abc5113fae5ce9
- SHA512 96b66ad3d7a09965f6c1f30f8fea25b8001794eabc35da857e7cdc5183225c6e5a6617ca53b84a946d678d59d622ad8fe025b165a41817ba073d90b3c14b66e2
- SSDEEP 12288:GGuD5lIem37FGWaCZfNUX108siizuu3lVPxoFLHah9uSWidgpm6hXrpXesu4llLB:GGEWem1gXq5L9uSWidgpm6hbpOSRKQ
- TLSH T10D653A11B7915028FDF316FA8AFE30AC993DB9E0072890C751C42AEE5A65BF17D32647
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_5222c57eba0c4e580d89a36de9c917e1_amadey_elex_luca-stealer_njrat_smoke-loader_wapomi.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Malware Config
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Targets
-
- Target 2026-08-05_5222c57eba0c4e580d89a36de9c917e1_amadey_elex_luca-stealer_njrat_smoke-loader_wapomi
- Size 1.5MB
- SHA256 101acd96b344cd899eb69196a259498544c38077c2e25997747a9284dc83e1ca
- MD5 5222c57eba0c4e580d89a36de9c917e1
- SHA1 ea8ce883a1e6bf3f69fa5e8399abc5113fae5ce9
- SHA512 96b66ad3d7a09965f6c1f30f8fea25b8001794eabc35da857e7cdc5183225c6e5a6617ca53b84a946d678d59d622ad8fe025b165a41817ba073d90b3c14b66e2
- SSDEEP 12288:GGuD5lIem37FGWaCZfNUX108siizuu3lVPxoFLHah9uSWidgpm6hXrpXesu4llLB:GGEWem1gXq5L9uSWidgpm6hbpOSRKQ
- TLSH T10D653A11B7915028FDF316FA8AFE30AC993DB9E0072890C751C42AEE5A65BF17D32647
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Bdaejec Backdoor.
Bdaejec is backdoor written in C++.
-
Detects executables packed with ASPack
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE