Extracted

• • Target
    2026-07-08_3a84bc46714c51a702313ed44c9f27bc_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 220KB
  • SHA256 dfea97d4adbc626bff0dce0e02ccb2a4c6b08a7e3f6c804adf5e02c2d95bf071
  • MD5 3a84bc46714c51a702313ed44c9f27bc
  • SHA1 2b328b8c4f12efea0eb62cee90b7ce98793233f4
  • SHA512 6b1ed0846030b47e771733c5755c1dca92814aa83fd7f634e152137509f3ba1503f082245cd7fb02ae7f161b1a8f30cdeb5485080dde395a1e6779be81a8090e
  • SSDEEP 3072:LJ0TAz6Mte4A+aaZx8EnCGVupcnDKW1LgppLRHMY0TBfJvjcTp5XYVM:NrFZaaZmEJuGDKW1Lgbdl0TBBvjc/YVM
  • TLSH
    T18D24CF2171C1C1B3C4B7113444EACA769A7A7032076A96D7B7ED27BA6F213E1A3352CD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistenceransomwarespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2