Extracted

• • Target
    2026-07-03_7a5400ce8d7fd9f4334b9e2bb231fe81_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 832KB
  • SHA256 b785f0a335e2a3748dc7266c669115c8d0d1b012a06438f93619a0a7024d3908
  • MD5 7a5400ce8d7fd9f4334b9e2bb231fe81
  • SHA1 0bb000a7f1d307dafc22ae738352b8e6dca60d29
  • SHA512 515540173682726d3f13a52c3c9346601c5adc98152a64d144b14f8617e0b89940fd310c4e980ed7f9ac2aa3e092693ccb016cb9e6ce1eb10376f0db0865505b
  • SSDEEP 24576:/Y+Wk70Trc18BSnLW2CRBKViu99LK1Rad6yZ2:okQTAKYS/v6h3+1uhZ2
  • TLSH
    T14A05122470C0C4B6D47B413544C9CB76AA76707247BA94DBBBDD63B6AF203E1A3352CA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistenceransomwarespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2