General
- Target 2026-10-01_37775d86115808c876ad5565f7795818_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader_wapomi
- Size 4.7MB
- Sample261002-t8glssed65
- SHA256 8921ab927384ac16c3a4237d91f9d8a4ea90d64c025659ebc9d0a8412ee28cb8
- MD5 37775d86115808c876ad5565f7795818
- SHA1 ae906bcd402791d8e38e94d6047efb92560b0c44
- SHA512 14f08f5242ec714930a75ac635d060b9dade16d04db614cc27cf6e4f57b00abcbb656d28e53b63d35dc2c960d0f21a0770acd6656fc628c5ef5a436aa02eb1c3
- SSDEEP 98304:WI4XFcGtDzrkL5e0wxOI1JMixFjzeABWW7I0:CFP85e3xXxpeABWW7D
- TLSH T14C36F1107546C0B2D4C801B09A3EAFAB567C5E740B2048D7B7C46EE9AE709E376B6F47
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_37775d86115808c876ad5565f7795818_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader_wapomi.exe
Resource
win10v2004-20260911-en
16 signatures
150 seconds
Malware Config
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Targets
-
- Target 2026-10-01_37775d86115808c876ad5565f7795818_akira_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader_wapomi
- Size 4.7MB
- SHA256 8921ab927384ac16c3a4237d91f9d8a4ea90d64c025659ebc9d0a8412ee28cb8
- MD5 37775d86115808c876ad5565f7795818
- SHA1 ae906bcd402791d8e38e94d6047efb92560b0c44
- SHA512 14f08f5242ec714930a75ac635d060b9dade16d04db614cc27cf6e4f57b00abcbb656d28e53b63d35dc2c960d0f21a0770acd6656fc628c5ef5a436aa02eb1c3
- SSDEEP 98304:WI4XFcGtDzrkL5e0wxOI1JMixFjzeABWW7I0:CFP85e3xXxpeABWW7D
- TLSH T14C36F1107546C0B2D4C801B09A3EAFAB567C5E740B2048D7B7C46EE9AE709E376B6F47
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Bdaejec Backdoor.
Bdaejec is backdoor written in C++.
-
Detects executables packed with ASPack
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.