Extracted

• • Target
    2026-07-07_e6da3f3ed263096ec2f7f1bcbf84aa4c_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 816KB
  • SHA256 c51a5885a45da641163b47de32a21ddf60510a907ae16dcd95fa9744d695de2f
  • MD5 e6da3f3ed263096ec2f7f1bcbf84aa4c
  • SHA1 3495dafed6444710e26813f0a895e1f4f7d1c1a4
  • SHA512 2f10fcbddb85597a60f4c288a41fb68e7cbd5bf9ba4628d7cb1ffa100622dbe0c576b3b07b78fd7903232cf69f5a7b3e37f167e16ef0d4dd87b081c96936032f
  • SSDEEP 24576:/Y+ok70Trc18BSnLW2CRBKViu99LK1Rad6v:akQTAKYS/v6h3+1uK
  • TLSH
    T11505122471C0C4B6D4BB013544D9CB72AE7670B247BA94DB7ADD63B6AF203E1A3352C9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistencespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2