Extracted

• • Target
    2026-07-08_3e6c1ad5e0b56bb65f6e5f63763476b5_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 358KB
  • SHA256 4486f1af0bdb2101a72f64e40e0fd6b8a8a3b1be62bac7a8068229af5b0d3dd9
  • MD5 3e6c1ad5e0b56bb65f6e5f63763476b5
  • SHA1 c66064f047fdbbc6108859705ec78c694255da97
  • SHA512 b5d71f1c09be8d4a07e32f4c703825a157cc61e7ea2e1c96685fc4f7b9d372188516ce31964052c98d5241cf8a4a0f2ec37b8d7b75d5d8e54e75c004b788604d
  • SSDEEP 6144:NrFZaaZmEJutDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2O:/bE+uFh1Lk70TnvjcsMxdABSnLHOr2O
  • TLSH
    T12574E02071C0C1B2D4BB113544EACA769A367C7247B995D7BADC37BAAE303E163352C9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistenceransomwarespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2