General
- Target 2026-10-17_de37a5be9874d8d85b810dfe060cbdf5_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee_wapomi
- Size 205KB
- Sample261018-ej1aaafz9p
- SHA256 205ac3939b404d5766bdefdd1d47c48803afd83c0dfe7e098e106eb2f4fdfaeb
- MD5 de37a5be9874d8d85b810dfe060cbdf5
- SHA1 22247752a3d67e63ce3ab8643abe0863969403f3
- SHA512 389e7c3ef649c5e55a8501caa24f97ec5fcad0797a0d44594b55e6c1d588f5b2fd2bdd1dc74c0b19e06f12ae869a6d18720d2a05e49f0791776711a878cfcc7e
- SSDEEP 3072:SJ3LOtoXrqdWoX8ib8qzsrEULieF8B6uRMEc7ly5NsZQ+GCH:SZgyrqdWjibwrEULieF66u/40seX
- TLSH T1D3246C253AD0C073D2A3307109D5E7B56ABEB9718F31968B7BD00B7D5F306919A2835B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-17_de37a5be9874d8d85b810dfe060cbdf5_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee_wapomi.exe
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Malware Config
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Targets
-
- Target 2026-10-17_de37a5be9874d8d85b810dfe060cbdf5_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee_wapomi
- Size 205KB
- SHA256 205ac3939b404d5766bdefdd1d47c48803afd83c0dfe7e098e106eb2f4fdfaeb
- MD5 de37a5be9874d8d85b810dfe060cbdf5
- SHA1 22247752a3d67e63ce3ab8643abe0863969403f3
- SHA512 389e7c3ef649c5e55a8501caa24f97ec5fcad0797a0d44594b55e6c1d588f5b2fd2bdd1dc74c0b19e06f12ae869a6d18720d2a05e49f0791776711a878cfcc7e
- SSDEEP 3072:SJ3LOtoXrqdWoX8ib8qzsrEULieF8B6uRMEc7ly5NsZQ+GCH:SZgyrqdWjibwrEULieF66u/40seX
- TLSH T1D3246C253AD0C073D2A3307109D5E7B56ABEB9718F31968B7BD00B7D5F306919A2835B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Bdaejec Backdoor.
Bdaejec is backdoor written in C++.
-
Detects executables packed with ASPack
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE