Extracted

• • Target
    2026-08-17_c3a8572a1aabadfa4aecccf56c7230d2_elex_glassworm_remcos_smoke-loader_stop_wapomi
  • Size 3.8MB
  • SHA256 5e91777ffb828dd7d4ae36ad53229fb3d51b0195778dd10c5dba1719b965f043
  • MD5 c3a8572a1aabadfa4aecccf56c7230d2
  • SHA1 aea97896cdfd74933cb2bd54f6aaaeb9689198af
  • SHA512 aa681efdfb01f13234b28bd94039d183dd7fded94d490af0e6df27a2e123f64d039ba9ad0bd2fee009e96507945c8ab4d8f7b624feb978f78f3715ccccd7bfa1
  • SSDEEP 49152:Belxi+ePLypOS4t3qYBDd25d0FFTG3vNz7:CSzNS4taYpd25dwI
  • TLSH
    T1F9068D41BBA3C0F6E5A6233840E15B974D39BF550B289ED3BBC4391E5A216D37C3B249
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoveryexecutionbdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2