Extracted

• • Target
    2026-11-04_7e2d895e87a080d2d83ddb20c4609dfc_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop_wapomi
  • Size 429KB
  • SHA256 031a873063a0028ea8bf542ad1b0f445a7dabd70b354faa5b78a1bd7b42cbe36
  • MD5 7e2d895e87a080d2d83ddb20c4609dfc
  • SHA1 47effb577af7b1565a91434811fb5cf3ed6fc6d1
  • SHA512 e8c123d45fc8f67ef6e564c288eb1954439b9700e4260c9e264928a70e8c5530b2ecc4afbe0bb1dc28781e0b1f18000a32d6c9c146fba6f803d9bddf7bc3cf54
  • SSDEEP 6144:xda9jGwttFo62sf9jp4xUN5jy+/VitT0j2nLbC8e20091VmGmZ5mJa08SPWqpY:xd0iyjpcUVkwj2n68e200rVmTZCrWq
  • TLSH
    T181947C11BBC0D476C2A631714AA7E37566B9AD309B2547C777C03E7E2E302D29E3970A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordiscoveryexecutionbdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec
  • Custom signature

    Detects executables packed with ASPack

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2