Extracted

• • Target
    2026-07-08_a221730df8ec5800f49153430863fe1e_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 240KB
  • SHA256 a8927e4909b4decf16f3b42c83174f25dd584b5826d21345c0505068f2d5a45c
  • MD5 a221730df8ec5800f49153430863fe1e
  • SHA1 2f717145ece266d566b923d2c9f25ba927dc4a03
  • SHA512 fe1572cfbfd3dabb315c0ffff96905ff12b3abba6cb685eaa6bf3df085196402b68dc673a6740b2518c70d8b887f2906a8cf0a4c120956e4d54749b7f2feebae
  • SSDEEP 6144:NrFZaaZmEJuaDKW1Lgbdl0TBBvjc/YVM6w:/bE+uch1Lk70TnvjcsM5
  • TLSH
    T12134CF2071C1C1B3C4B7113444EACA769A7A707207AA95D7BBDD17BA6F213E1A3352CD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistenceransomwarespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2