Extracted

• • Target
    2026-06-27_62bcaff3d2010f9559fa3606ef9ebf22_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 897KB
  • SHA256 92290b57cf1f2274555137ccd56301744d46fc1148649da282ef80de811b5747
  • MD5 62bcaff3d2010f9559fa3606ef9ebf22
  • SHA1 0fe1dbe3060164692b5fbb9a7a7e43985388c48f
  • SHA512 b50f0492e6cbd0c055c7103e88ffc1566a25b2f97ef631c91d9541fb258da25a6225afcec8630328c5272949fd9ae3ac9e41a3f8cfe4908708b74bba6b473e13
  • SSDEEP 24576:/Y+gk70Trc18BSnLW2CRBKViu99LK1Rad6yZcTT:ikQTAKYS/v6h3+1uhZcTT
  • TLSH
    T11D15222471C0C4B2D477413544C9CA76AA36707247BE99DBBBED63B9AF203E163352CA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistenceransomwarespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2