Extracted

• • Target
    2026-08-12_e26b9aa0853fef4560c53831e740bae7_elex_smoke-loader_wapomi
  • Size 27KB
  • SHA256 4b060e8e61f811fbb48002b6cd28742834da12ff71ad8d6f3e1eaab1ce066db5
  • MD5 e26b9aa0853fef4560c53831e740bae7
  • SHA1 5557695d2396e8f3a073fb926c80998f7c933854
  • SHA512 a3756aa8ed08e9cce61d248a1cb4f2633fd5c6d4c85e369c1692aabd2f41fb81897b50f0ead1e536e18575efb6a41f6e1ed07257a5a4580fa5576e995402445d
  • SSDEEP 384:TH5rSYXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:j52wQGPL4vzZq2o9W7GsxBbPr
  • TLSH
    T1AFC2AEB38FD084FBD4DE3A3250A6364B8AB758704AB5E1AF8631446A6CB7F05EC70465
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoveryexecutionbdaejecpersistence

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2