Extracted

• • Target
    2026-11-02_9d62f48415c66d5c0bf486ba705d61e4_elex_smoke-loader_wapomi
  • Size 2.0MB
  • SHA256 9fc9238c62360c3ee4ae93e95976a4c3ea6da35f0054388a79679544b322ba53
  • MD5 9d62f48415c66d5c0bf486ba705d61e4
  • SHA1 c53bfe3a07523ba9b6bf5f0517892c7ef9b34fd7
  • SHA512 30b5a5ad790f7b26b01cbce62a5e0e3b37565e07ff2092d68f019b7403631f82119e1bfaefedd744434df250628fe3e64fcaad6120ae45a1660c141d094e7087
  • SSDEEP 24576:cC1bwSpayb6UfjGSQYaXuKjvyeaWDyBzYNV+x2qShcFnuQtn6Itlbe7pnORzGaSI:c3SjbhjG7YaVmWDSzYNVQ2QtfTupnO9
  • TLSH
    T1BCA533247B702596CD5709F8C3378325529BDE0E2238F3F466813CE92E6A744EB29936
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordefense_evasiondiscoveryexecutionbdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec
  • Custom signature

    Detects executables packed with ASPack

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2