Extracted

• • Target
    2026-06-29_c15be8bfa964200bb8c1cf2ecd6b0e28_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 1.1MB
  • SHA256 c400f0bc8639fcdee712d9a0f2bbd6bb7d78f641d57a7f51bb3216d51861681b
  • MD5 c15be8bfa964200bb8c1cf2ecd6b0e28
  • SHA1 3a2ab57e04d1b83c9df3d30ec28f69c032425522
  • SHA512 bd84f1f9b5dd4da945083d07b53de980d0641b6edcff3eae26f675c9381d9f8c8d0a12b6146318ca6a789c622278fcef808bef316395fe21b414a702de0e328b
  • SSDEEP 24576:/Y++k70Trc18BSnLW2CRBKViu99LK1Rad6yZcT29fhducOyLBP0X:kkQTAKYS/v6h3+1uhZcT2NnvOyLA
  • TLSH
    T12C35232461C0C4B7D46B413644C9CB76AA36707247BA89DBBBED63F5AF203E163352C9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistencespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2