Extracted

• • Target
    2026-11-05_e18ecc6b2c83a4c60bcd18bc6a3f4a66_elex_smoke-loader_wapomi
  • Size 18.4MB
  • SHA256 5774258ddfbb3fe8c1b7966e72ccfbc55f7919b623d15f04d7d4cfc8ffec6f01
  • MD5 e18ecc6b2c83a4c60bcd18bc6a3f4a66
  • SHA1 abc6bf4d83cca702357675b2918850f2b4c1e57a
  • SHA512 67492e18b814454aa0c1feb1013690e4a556242cedbadc20e2888eb998ed53e578bd53590f8c22e5ad50b675d53ebf87e625a8b48d3b838f95402066142af660
  • SSDEEP 393216:MAdhXW3QHk06Ith0lry5oOEI6bHhy8iiNxTyZVicU1MJD17OyVMlu:fdEAA0Sluoq6bBybiTgUVUDFOyV9
  • TLSH
    T1901723AF18CB41EAD5C11CF4971B6AEB07B3A6994BC98C3429C57449B0B1FB7207D8E4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoordefense_evasiondiscoveryexecutionbdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec
  • Custom signature

    Detects executables packed with ASPack

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2