Extracted

• • Target
    2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi
  • Size 280KB
  • SHA256 aef55b204ce10383ffd0ac4a3530fa68de09b27c0226a9b3743c0a4e5bca538a
  • MD5 33adc68082c10538009a4fbdc87619fd
  • SHA1 dd75ce2503f06f6afe1aebc712c9e25e8a130df8
  • SHA512 0b88cad5e2fa3fdc592961e23e3b3de9f04e43915370b14e49a9dd9e1692f0659ba09fa33ee60c0d52945015298d20c732a17ebd4e027def32b983edca629458
  • SSDEEP 3072:4OXQ2G+IpQZQneFAMx3qe8UzT+nWwXjDRJWwXjDRgjDRbL7SC7tTGCH:XvGlpQEQAMtqNUzCCtK
  • TLSH
    T108544A82967A59D1D818CD3005A634E557EF2C1338079E57F36BFF1F28BADD0AA0E612
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoorcredential_accessdiscoveryexecutionbdaejecpersistencespywarestealer

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2