General
- Target 2026-10-23_9e67df2541b6632e3d337ae0e88a79b5_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_wapomi
- Size 79KB
- Sample261023-k5sefsce77
- SHA256 90e887357b0dd922d951e46c1b22a7686398df687ca984a5e75db0c05dba00c4
- MD5 9e67df2541b6632e3d337ae0e88a79b5
- SHA1 f0d929faba4ea2b2d69399836a413d1b50330340
- SHA512 4fea2b37f0fd6d39c9a79a69a9d2325cb4837f05126a270454ef070c0f16f6ab7a9281f2704da608ec589d13c5da14e2152e4f4f3b5473f088af9899a65a7b48
- SSDEEP 1536:aa0wstmSpDaGS2RCSxK28otXFQwUxbTGCq2iW7z:HHstlC2R7JbQwUxXGCH
- TLSH T1A2837D11BA90C03AE0A225304DB5D3A28E3EBC31577994CF7794167D1EB27E2ED78366
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-23_9e67df2541b6632e3d337ae0e88a79b5_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_wapomi.exe
Resource
win10v2004-20260911-en
12 signatures
150 seconds
Malware Config
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Targets
-
- Target 2026-10-23_9e67df2541b6632e3d337ae0e88a79b5_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_wapomi
- Size 79KB
- SHA256 90e887357b0dd922d951e46c1b22a7686398df687ca984a5e75db0c05dba00c4
- MD5 9e67df2541b6632e3d337ae0e88a79b5
- SHA1 f0d929faba4ea2b2d69399836a413d1b50330340
- SHA512 4fea2b37f0fd6d39c9a79a69a9d2325cb4837f05126a270454ef070c0f16f6ab7a9281f2704da608ec589d13c5da14e2152e4f4f3b5473f088af9899a65a7b48
- SSDEEP 1536:aa0wstmSpDaGS2RCSxK28otXFQwUxbTGCq2iW7z:HHstlC2R7JbQwUxXGCH
- TLSH T1A2837D11BA90C03AE0A225304DB5D3A28E3EBC31577994CF7794167D1EB27E2ED78366
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Bdaejec Backdoor.
Bdaejec is backdoor written in C++.
-
Detects executables packed with ASPack
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE