Extracted

• • Target
    2026-07-05_27ffa45b98a46ce28fd307b2b40f3934_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 288KB
  • SHA256 758c331773c7be08f27ff0ef916370e36aa9b83c07022ce3857f33a1159f62e1
  • MD5 27ffa45b98a46ce28fd307b2b40f3934
  • SHA1 d146b4e8482b9ea17000c66a9274a1a315dd61f5
  • SHA512 2000b58b8a8712c5d8e76ee2aa149c5b9cf65a03a57090131e5254feeea03e3a4ac3bd8daaad95c548063067a1af9331cafa2b2cd7a8fb5b2dabfbbb7a2467ae
  • SSDEEP 6144:NrFZaaZmEJuUDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRx:/bE+uCh1Lk70TnvjcsMxdABS/
  • TLSH
    T12D54E02071C1C1B3C4B7003544EACA769A7A707247BA95D7B7DD27BAAE113E1A3352CE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistenceransomwarespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2