Extracted

• • Target
    2026-09-26_583ca135f596be1e01af23f43e14b63a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee_wapomi
  • Size 7.0MB
  • SHA256 6e6b400b71b2322501e713108df1c9855208fc5ab42a92c8b07e394365f6d81d
  • MD5 583ca135f596be1e01af23f43e14b63a
  • SHA1 daaa67eae10f5c10e11522ef965c705f1467b1f6
  • SHA512 9e8be57c7ffb10049d66f03a0e40b5aa0260130885e6b538b59e45df0e2f460c0ad6d6f78ea1eb75ad9e0976f6bb3ca4cf6143399311697726ca53134372260f
  • SSDEEP 196608:lI0xD5OkGWOQWs4mmAJ9g6vEjpJBDrrtz3kk:OqD5OrWOQWRjse6vU75rZzUk
  • TLSH
    T1977633BCB580C772D4B51A7051F14E78E63330A507AAC493B6B8997FBA261A197733C3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoveryexecutionbdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detects executables packed with ASPack

  • Detects executables packed with unregistered version of .NET Reactor

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2