General
- Target 2026-10-13_9e6b129262a742fa73d4b07e8ed2d2ab_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_wapomi
- Size 60KB
- Sample261015-jh96bach63
- SHA256 2274893bdd15658bb1c5f37f46a14ea181ca9d0bdc1b4e138f4dedd80a7c91af
- MD5 9e6b129262a742fa73d4b07e8ed2d2ab
- SHA1 abec43917370d1651027733f13cba448d2dbc8bc
- SHA512 56289cafa2ce541adf8c67a095feb53e866a8df4360b7c986b575006dcabce111a84ab860af5ef10f2461e77334fe96afd07ee7ff40e396b33744a26319c3fbc
- SSDEEP 1536:50OSw77rTpj3U/DY7PcZ6CbGqKGCq2iW7z:aOx7mkQZ6COGCH
- TLSH T16E537C12B7A0C076D48235305879C7B29F7FB87256B8859B7B9406BE8FB13C0AD29357
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-13_9e6b129262a742fa73d4b07e8ed2d2ab_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_wapomi.exe
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Malware Config
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Targets
-
- Target 2026-10-13_9e6b129262a742fa73d4b07e8ed2d2ab_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_wapomi
- Size 60KB
- SHA256 2274893bdd15658bb1c5f37f46a14ea181ca9d0bdc1b4e138f4dedd80a7c91af
- MD5 9e6b129262a742fa73d4b07e8ed2d2ab
- SHA1 abec43917370d1651027733f13cba448d2dbc8bc
- SHA512 56289cafa2ce541adf8c67a095feb53e866a8df4360b7c986b575006dcabce111a84ab860af5ef10f2461e77334fe96afd07ee7ff40e396b33744a26319c3fbc
- SSDEEP 1536:50OSw77rTpj3U/DY7PcZ6CbGqKGCq2iW7z:aOx7mkQZ6COGCH
- TLSH T16E537C12B7A0C076D48235305879C7B29F7FB87256B8859B7B9406BE8FB13C0AD29357
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Bdaejec Backdoor.
Bdaejec is backdoor written in C++.
-
Detects executables packed with ASPack
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE