Extracted

• • Target
    2026-07-07_0121046a0fa24d9fea40c199a1e0321e_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 220KB
  • SHA256 7024c54456d07897c18ef0691ae51064a0a23a17776321a8a3e1b0b437f7277d
  • MD5 0121046a0fa24d9fea40c199a1e0321e
  • SHA1 a7512c263b4efefb002dc6137e891b9534378ef1
  • SHA512 2047302b9501b2067580345ea3ff7c05b0e2cd2c5eb56a26e7c3e0d4a90e53273fc4983584dd7c4c173b4e4bcc5d7cc42d9a98bcb884b9878618d4877ef31626
  • SSDEEP 3072:LJ0TAz6Mte4A+aaZx8EnCGVuWcnDKW1LgppLRHMY0TBfJvjcTp5XYVM:NrFZaaZmEJuNDKW1Lgbdl0TBBvjc/YVM
  • TLSH
    T14224CF2171C1C1B3C4B7113444EACA769A7A7032076A96D7B7ED27BA6F213E1A3352CD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistencespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2