Extracted

• • Target
    2026-11-01_a2a98643c1b596320c6dbe86ff123625_coinminer_elex_ramnit_smoke-loader_wapomi
  • Size 71KB
  • SHA256 cdbabfef41204e312f93c0db41e21e549e5ae17ae2cf0b1c412c2bf8c5df7a0e
  • MD5 a2a98643c1b596320c6dbe86ff123625
  • SHA1 c6671c41202df0cb4073b2b72e6a6ece3397dc39
  • SHA512 0d6e3186cd2aab1b7798a5114612f10ce1abcee6f42bff75d1c31135cd7b7b23ec6b503e1f0fec650262328a5b9630974e193cdc69fd55849d4616549a90d7d3
  • SSDEEP 1536:T+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzEOqGCq2iW7z:iROzoTq0+RO7IwnYJGCH
  • TLSH
    T14763F2C29F0501F3CABA253310E496A5CFA57C618B7779AFE6600027BF89422AC17E59
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareaspackv2backdoorbankerdiscoveryexecutionbdaejecramnitspywarestealertrojanupxworm

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Family: Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Detects executables packed with ASPack

  • UPX dump on OEP (original entry point)

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1