Extracted

• • Target
    2026-09-03_e61ace94c7b6a749583b21463a6030c8_coinminer_elex_smoke-loader_wapomi
  • Size 76KB
  • SHA256 fafbf615edc35d6362e799623ba825040904cc35a4b1942d1bd9faa282ef0402
  • MD5 e61ace94c7b6a749583b21463a6030c8
  • SHA1 a72fe489a3940c41b7692c11f41a6957537b0f92
  • SHA512 3f9e3ede72fc56b3ddc3f18e0bfffc7cdd5677e558dd39a31a26c7738560effc67f14fb94906ea545bb67651cf35e394c6c260c5c420d4a77defe43c78d128ef
  • SSDEEP 1536:2ilGC+HMax3AZ5GiavgfreZCRIr71mazhAN5TASHAGCq2iW7z:2igLV3SIareERU5mazh3SgGCH
  • TLSH
    T10573012386E05CF1FA6901729390F747D92B886193A68E77B26E4D2B4F93CD1CD324B5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordefense_evasiondiscoveryexecutionbdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • UPX dump on OEP (original entry point)

  • Blocks application from running via registry modification

    Adds application to list of disallowed applications.

    defense_evasion

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables cmd.exe use via registry modification

    defense_evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2