Extracted

• • Target
    2026-09-04_8ff6bb595abd7fbb6f37c34340c7d56f_elex_smoke-loader_wapomi
  • Size 9.9MB
  • SHA256 80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504
  • MD5 8ff6bb595abd7fbb6f37c34340c7d56f
  • SHA1 3a73a50899632180cb4681b8b068720e6862ca67
  • SHA512 05abcb70d7ee01ada537e07c0a02975778731d8800a06a09456519a4a95a2142347756075f17362a16de45a672fcc1ce8b82d16d5df10b60564e0e16ef5333f6
  • SSDEEP 196608:YeueXuaQ765KHOQBzZRpiZUkol9+smtbVzc3QLj9Pw8C5vtUsFm1sT3nBsxraSN3:rbWH5BTU+k++Rx/LjNsvtUsM1sT3BWaI
  • TLSH
    T1E4A633751A41C247E77C8A740FD8FA726ECFED65D4A8E523B79139B7B630E48AA01403
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordefense_evasiondiscoveryexecutionbdaejecthemidatrojan

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Detects executables packed with Themida

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • UPX dump on OEP (original entry point)

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral1behavioral2