Extracted

• • Target
    2026-06-29_407664652c50a69cf851ebd3f0ee8fe4_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 1.1MB
  • SHA256 0e8f75bf39a31f1ee02153962724bc6b809fcb8198f779c97772a8c577111bee
  • MD5 407664652c50a69cf851ebd3f0ee8fe4
  • SHA1 beb3ee439da3823d7ce65026713db955f6685800
  • SHA512 f61201018fc9bc2bdd0ecd972db5469f952f601b4477f4bab1d9110b92f52aff38684fea0f78181c93c98db7ceebd8c250b27a401082fbd924b1c131e31a47df
  • SSDEEP 24576:/Y+6k70Trc18BSnLW2CRBKViu99LK1Rad6yZcT29fhducOyLBP02:YkQTAKYS/v6h3+1uhZcT2NnvOyLp
  • TLSH
    T1C135232471C0C4B7D46B403544C9CA76AA76B07247BA89DBBBDD63F9AF203E163352C9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistencespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2