Extracted

Extracted

• • Target
    2026-08-21_d8f219effd32e4a9b15320bb9747fa00_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader_wapomi
  • Size 18.8MB
  • SHA256 f3bbea355419af7fc993a14ec64ba485950d168b89482619ec03869f93b7a23c
  • MD5 d8f219effd32e4a9b15320bb9747fa00
  • SHA1 359059fa88851776e45b72639a5b3036b3f49b82
  • SHA512 1bdcfb706315bd7df1e0b3b24ff6c68134ed1b2169e8fa25d85c132cb26855381878d5266ac941fcc4d4bebb8aeaa6fa1300c9bdf64866b2adc39edeb0a2790d
  • SSDEEP 393216:/0YJDAteOIHe0wAN77d/8bjSASrG2pkDEfH2wBVe8SwLQsW:v9At/f47d/8KZrlkmH2eEwn
  • TLSH
    T1641712B93A1AE1EFC1550C34B452DE86E73B33D046049A09FADA39BC8E52D5617CA7CC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordefense_evasiondiscoveryexecutionbdaejecxredpersistencethemidatrojan

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Detects executables packed with ASPack

  • Detects executables packed with Themida

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2