Extracted

• • Target
    2026-07-09_5fcc3d0b67679d5f22d3d1ceb59995cf_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 944KB
  • SHA256 8b226d88ff5bd46ab07aea392536331feab31ec6cac76ccbb03a2c3c4c954d2b
  • MD5 5fcc3d0b67679d5f22d3d1ceb59995cf
  • SHA1 f0a1829f781e830bbf684dc28333790073aee91b
  • SHA512 75a64b1dcf053e00a541393722f44d5a760acc60432a9ba19b0ed00930759e8b15a947e55bab897e73a14821b8b0cf7742866a104a36d1ed54cf962ba1c573c6
  • SSDEEP 24576:/Y+Ak70Trc18BSnLW2CRBKViu99LK1Rad6yZcT29f3:akQTAKYS/v6h3+1uhZcT2N3
  • TLSH
    T1BC25222471C0C4B3D46B413644C9CA76A976B07247BE89DBBBED63B5AF203E063356C9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloadersnojanupxadwarepersistenceransomwarespyware

  • Family: Snojan

    Snojan is a downloader used to drop and execute other malware.

    downloadersnojan

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2