Extracted

• • Target
    2026-06-30_1f850a58c19bd5a07b54ebfdfd4a4942_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 218KB
  • SHA256 939fe40a637a24bc988188852cff7f7720855f031bd1ba7dd99045f92e6f0cf9
  • MD5 1f850a58c19bd5a07b54ebfdfd4a4942
  • SHA1 11a768b5619f9cc656c9b6641b7f70afccff782b
  • SHA512 6291cb22191d9368bf2c77c0734439ff83ce9d172aec0f929f46eb79a58a24aa94411c5bcf1052dfa58cfbbed823eaa2dfe0f44f6b8172f140b04ab88a2c3ba7
  • SSDEEP 3072:LJ0TAz6Mte4A+aaZx8EnCGVuCcnDKW1LgppLRHMY0TBfJvjcTp5X:NrFZaaZmEJuBDKW1Lgbdl0TBBvjc/
  • TLSH
    T12A24CF2171C1C1B3C4B7113444EACA769A7A703207AA95D7B7ED27BA6F213E1A3352CD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistenceransomwarespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan
  • Custom signature

    UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2