Extracted

• • Target
    2026-07-07_3e4504c04ac9633b94ea8ee8216ae275_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 746KB
  • SHA256 00651bd6d56f161b18a58636ef56a16794253af5db6a4455950693624560307b
  • MD5 3e4504c04ac9633b94ea8ee8216ae275
  • SHA1 2fdb7450c4739d963578642d1bfdc6c3a218335c
  • SHA512 937d3c1a2ad6d6322174213979504a2ad649bceec48c5ef6bd825027f1137e20bfa06283e3b38e7cd8cad460164fd31804259827437ff3e7cd46677234e8732d
  • SSDEEP 12288:/bE+u8h1Lk70TnvjcsMxdABSnLHOr2fqRVnRj1wTVtYSqvu99LKC8Rad6h:/Y+3k70Trc18BSnLW2CRBKViu99LK1R1
  • TLSH
    T112F4122071C0C0B6D8BB113544D9CA76AE76707247B985DBB7ED63BAAF203E163352C9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistenceransomwarespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2