Extracted

• • Target
    2026-08-22_e4f9c80947ada06ad1839327050c9232_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi
  • Size 8.1MB
  • SHA256 81c511437a996ab6720c8dd8c6eee5a77fdf61b9e87ad8b32f47063b58f1e584
  • MD5 e4f9c80947ada06ad1839327050c9232
  • SHA1 ce7f5f188452ff5fd2d2a3e0526ab0c4f5567a98
  • SHA512 5113f8e03a28a44c0e79511783d9c9cd2a2a37e7a6807feb0d3b4da6e5421997cf2ce84467c2ba108ffcb934b8b5d21bd64f7c1607bc6b94ec41c75e1cbf86c1
  • SSDEEP 196608:MCeaXNfznIX1UYdtnyLqAkhPkjOFm372:MXaXGd6k5I
  • TLSH
    T1CC8623317181C236C15315718626E2A05F3AFC2817F1858B779EFA7E2F36AD0EA76346
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareaspackv2backdoordiscoveryexecutionbdaejecpersistenceprivilege_escalationransomwarespywarestealer

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2