Extracted

• • Target
    2026-06-30_252ff4611b0fb675770e6cebeac0d282_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 220KB
  • SHA256 d31d136414d53492c06008d60d1eca6a9ed58c493d5e527398157ae89531da87
  • MD5 252ff4611b0fb675770e6cebeac0d282
  • SHA1 6c3dddb579b6fc3271cd1abff8d72f28335ac20e
  • SHA512 5a394586541ab3f76daed7b40d017270a3b45aca9dd1601a8231cc9d6eef457ddae64db8dcb9b945fda6d0fcd47ef41d7bd2e9b703c56980d28faa7794e052e2
  • SSDEEP 3072:LJ0TAz6Mte4A+aaZx8EnCGVu/cnDKW1LgppLRHMY0TBfJvjcTp5XYVM:NrFZaaZmEJu0DKW1Lgbdl0TBBvjc/YVM
  • TLSH
    T19D24CF2171C1C1B3C4B7113444EACA769A7A7032076A96D7B7ED27BA6F213E1A3352CD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistenceransomwarespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2