Extracted

• • Target
    2026-07-07_044b70d30b306d629a932a4ec26dabc4_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 448KB
  • SHA256 5ae5b88c9db47b049795c9759842d7e2f98eead362614719db781ff754327d4b
  • MD5 044b70d30b306d629a932a4ec26dabc4
  • SHA1 1fb8384f232883908a145a458d91378445149915
  • SHA512 8d2984ee50df56fd381ffa40628239db036e09f65b03ec20c961836b3aa095625a53f281a9233ad50e6bef33a58eebbe0cb94c7f994be633d817e23a688bbecd
  • SSDEEP 12288:/bE+uyh1Lk70TnvjcsMxdABSnLHOr2fqRVs:/Y+1k70Trc18BSnLW2CRy
  • TLSH
    T1F0A4022071C1C0B2D4BB113544EACA369E36707247B9D5DBBBDD67B66E202E1A3352CE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistencespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2