Extracted

• • Target
    2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi
  • Size 5.8MB
  • SHA256 b28935f7f595b2b84997109368a57641b9a7766191986cf070758574736c3c5f
  • MD5 a95a0e4c2829b612bedc2ba39e230e9c
  • SHA1 d1b82721b1d0f265bd59121e88c7e862cab4057a
  • SHA512 79f9e37fc9630d44bc44d74c148b20304c476336c951e4922c5e9b6f963b208d4e7b72a90701d74a5fd6a86578bd83f7b61893a7894811e91e12362ae0d5872f
  • SSDEEP 98304:W3MjdiFDQKdn95BbP4KCcR8qLf3gbz2FSmaI7dlm:ZiDQKd9bzQbz2FSmaI7dl
  • TLSH
    T172569E52BF4D817AC95A2131472DAF2A502EFCA4773451D3B2743E7EEC763C12839A1A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareaspackv2backdoordefense_evasiondiscoveryexecutionbdaejecpersistencespywarestealertrojanphishing

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables packed with ASPack

  • A potential corporate email address has been identified in the URL

    phishing

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  behavioral1behavioral2