Extracted

• • Target
    2026-07-08_5c4e7e422e5628392c9c8754cb637ddd_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 220KB
  • SHA256 2b0154b1c4aab82ba8a5b9cf3b97f2aabdbe9b954f52bc7369a878ed1abcc5b7
  • MD5 5c4e7e422e5628392c9c8754cb637ddd
  • SHA1 bcce8f043baf8ba84b34efa9e11b376c70810dc4
  • SHA512 1705ca8f65279f59ac138493120ac983e54bce5b1b02c211e12877c98e13f1b5a2a215f28bdc1ad5834016933f8b27226a5482b6b6f49fb7019e249af04c6030
  • SSDEEP 3072:LJ0TAz6Mte4A+aaZx8EnCGVuDcnDKW1LgppLRHMY0TBfJvjcTp5XYVM:NrFZaaZmEJuADKW1Lgbdl0TBBvjc/YVM
  • TLSH
    T1BA24CF2171C1C1B3C4B7113444EACA769A7A7032076A96D7B7ED27BA6F213E1A3352CD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistenceransomwarespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2