Extracted

• • Target
    2026-07-08_fd7ea81be2e6e00b1346a5a90c6d5b51_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 448KB
  • SHA256 7f40478ce661463e12df9ef18a248af412631df706cfb451999e717a0f0248c2
  • MD5 fd7ea81be2e6e00b1346a5a90c6d5b51
  • SHA1 07719d943018696bd22cbd24bd3fbee115d2bb21
  • SHA512 5286963f82a12e768249f28e15cb892d54a823cee223c1c387d3ba3f7c2658fcbad999504f73aa3fb4e48e881ec01c14a294985097806f5c98ad2da250e8ff1a
  • SSDEEP 12288:/bE+uvh1Lk70TnvjcsMxdABSnLHOr2fqRVs:/Y+Ik70Trc18BSnLW2CRy
  • TLSH
    T1B4A4022071C1C0B2D4BB113544EACA369E36707247B9D5DBBBDD67B66E202E1A3352CE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistenceransomwarespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2