Extracted

• • Target
    2026-06-30_cfc099fc92b8be9ac91fbd7133ec93bb_coinminer_elex_rhadamanthys_stop
  • Size 144KB
  • SHA256 5587a2c952848a772d35600fe793b80ee3042e04dced3efe4b03a51cf230a737
  • MD5 cfc099fc92b8be9ac91fbd7133ec93bb
  • SHA1 b1db87992da6b85ffca8baded5796e05ae5720fa
  • SHA512 a3d70ea048ada5115fbcc8aaf7e1b007bbaf0ee539cf2f9c92dc0d866010ebb437e3ab79728593ef6b52e717f20fce8e0bacfb588e58b4a018509934d831b290
  • SSDEEP 1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+xK1xxKY+T6KWl:LJ0TAz6Mte4A+aaZx8EnCGVuxcnDKW1P
  • TLSH
    T13CE3E120A2D680F2D493627502AD86779D3E1077072EE6E7D7E576A3AD213F1F23608D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistenceransomwarespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2