Extracted

• • Target
    2026-08-21_a9c71886251b2dd8dd7ca79af7432b75_elex_glassworm_hacktools_mimikatz_smoke-loader_wapomi
  • Size 851KB
  • SHA256 c7bb7ab74c32f7287ee6a766c5385d5e0323d7330f36b6b1fbe1e33323d9d3ca
  • MD5 a9c71886251b2dd8dd7ca79af7432b75
  • SHA1 8f5eefcb98d1ac4295b3e4f2734a6f7a4d865482
  • SHA512 de257bba4a5e638b06804d19659b8afb7aed3ba7e9436a907e8abc49c2706e2aecfcda1d90cf275b7ed78b4b29f49a04ba1b9b0fe837d111989f8cdb7d9f11f1
  • SSDEEP 12288:Ow3GyVaIUxFVZmMMwZJoIAhzs32161mwfssk5CaSsu7:OvyVTU7cwZJoIOsa61r+CX
  • TLSH
    T149053C51B7E64065F2B32EB06EF2A6118E7B7CE61831C10F529C454F5EB3A909D3A732
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoveryexecutionbdaejecmimikatz

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • mimikatz is an open source tool to dump credentials on Windows

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables packed with ASPack

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2