Extracted

• • Target
    2026-07-06_ca475e0357744d364fff0dadc8caac82_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 496KB
  • SHA256 705a39a4185bff5c6315f39fa0b8889fb82b93215081d324404a136d436d25f8
  • MD5 ca475e0357744d364fff0dadc8caac82
  • SHA1 7ad8c13b4c6c2859fbd0e9cc06e8c8edbe7ecaa7
  • SHA512 540c6fd976ac8efeed71eb21d4573137fb0f27930d7eceb40e001ecc0e3ee190ad841792db5ee3bd4e9cd255af2d1b8c47f2dd118196f5e639e272098b1c5b35
  • SSDEEP 12288:/bE+ubh1Lk70TnvjcsMxdABSnLHOr2fqRVnRjx:/Y+0k70Trc18BSnLW2CRBz
  • TLSH
    T1D7B4022071C0C0B7D4BB113544E9CA369A76707147B9D5DBBAEC67BAAF202E163352CE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistencespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2