Extracted

Extracted

• • Target
    2026-08-08_4378a9c0f4418c9e12377eae10117414_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop_wapomi
  • Size 1.5MB
  • SHA256 f48327967b00f6c3fd30939eb30b25a9615e298865613cc2484e11d85f6a5304
  • MD5 4378a9c0f4418c9e12377eae10117414
  • SHA1 0ddf326c19a7144117af19cec90a8500ad16b0c9
  • SHA512 ae3e809795371efbdf80f44f550c890054c643d64a3396b830d576a27e6999302dc38351bd9cc24ace4ce71483290b97f5c63ff341ea23605cadc739ac72e50e
  • SSDEEP 24576:InsJ39LyjbJkQFMhmC+6GD9+wfLrvi4cRIyDe3SUNaXy+WypoGHg:InsHyjtk2MYC5GDf+i3DsX1WH5
  • TLSH
    T19775C022B1D18837D177163D8C7B93A4583ABE512E24794B3BE43E4DDF3A281A9352D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoveryexecutionbdaejecxredpersistence

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Detects executables packed with ASPack

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2