Extracted

• • Target
    2026-07-02_5c7135897271aec1a315136e615e1fa0_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 608KB
  • SHA256 f60a3407b2be92e74cc67e2a1eeac4293228fcf95e0ee7e3c3f174111ea81a16
  • MD5 5c7135897271aec1a315136e615e1fa0
  • SHA1 2ecf95c85f2815f791c99ba947179edba7382748
  • SHA512 a1b1a53ff33a33b009f8686ee4bea4a737a5c06f5de78479802d8723c916eaa5eb022718dae65cb13fff23ed91bc0c98b2a5eda314bbd0d96c72bf51c810f81d
  • SSDEEP 12288:/bE+ukh1Lk70TnvjcsMxdABSnLHOr2fqRVnRj1wTVtYSqvC:/Y+bk70Trc18BSnLW2CRBKViC
  • TLSH
    T16CD4122071C0C4B6D4BB113444E9CA729A76707247B995DBBBDC67BAAF203E1A3352CD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistenceransomwarespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2