snojan | 23cac1b20f74baae5ad0d9a9cea45b45f84802d89ab8e21f91747d6c66d7fb6c

General

Target
23cac1b20f74baae5ad0d9a9cea45b45f84802d89ab8e21f91747d6c66d7fb6c
Size 172KB
Sample260910-lp88ps1enf
SHA256 23cac1b20f74baae5ad0d9a9cea45b45f84802d89ab8e21f91747d6c66d7fb6c
MD5 5b5023e9b1a774d63f51c5308c2d3546
SHA1 ecbf09342864605fbd1cb9ba55977ee1240b6db6
SHA512 94d0dad6732db38795090990176e4b31fcfd49dbf005590f772a194c7e572b9c4f09f627fdcef11304d25ec89f9783b6548b25b95e264ae1b17af3f005a5247c
SSDEEP 3072:zs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/E/FnncrBPh1:zDeM7iNEkgiOb31k1ECSJu51
TLSH
T107045C20A998E4F3E8A301F105445B716E71DD35161ACA83E3D6EF79A9B4311DB8C3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx downloader snojan

Malware Config

Extracted

Family

snojan

C2

http://wecan.hasthe.technology/upload

Signatures

Family: Snojan
Snojan is a downloader used to drop and execute other malware.
downloader snojan

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23cac1b20f74baae5ad0d9a9cea45b45f84802d89ab8e21f91747d6c66d7fb6c

File Explorer

23cac1b20f74baae5ad0d9a9cea45b45f84802d89ab8e21f91747d6c66d7fb6c

.exe 172KB

23cac1b20f74baae5ad0d9a9cea45b45f84802d89ab8e21f91747d6c66d7fb6c

IMPHASH 0610e3122d836e63ce854b2e7aa102c2
SHA256 23cac1b20f74baae5ad0d9a9cea45b45f84802d89ab8e21f91747d6c66d7fb6c
MD5 5b5023e9b1a774d63f51c5308c2d3546
SHA1 ecbf09342864605fbd1cb9ba55977ee1240b6db6
SHA512 94d0dad6732db38795090990176e4b31fcfd49dbf005590f772a194c7e572b9c4f09f627fdcef11304d25ec89f9783b6548b25b95e264ae1b17af3f005a5247c
SSDEEP 3072:zs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/E/FnncrBPh1:zDeM7iNEkgiOb31k1ECSJu51
TLSH
T107045C20A998E4F3E8A301F105445B716E71DD35161ACA83E3D6EF79A9B4311DB8C3BE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

165787

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext

kernel32

ExitProcess ExpandEnvironmentStringsA FormatMessageA GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetTickCount GetVersionExA SetLastError SetUnhandledExceptionFilter Sleep SleepEx

msvcrt

_read _mbsdup _unlink _write __getmainargs __mb_cur_max __p__environ __p__fmode __set_app_type _cexit _errno _iob _isctype _onexit _pctype _setmode _stati64 _strcmpi _strnicmp _sys_nerr atexit calloc fclose fflush fgets fopen fprintf fputc fputs fread free fseek ftell fwrite getenv gmtime malloc mbstowcs memchr memcmp memcpy memmove memset printf puts qsort rand realloc setlocale signal sprintf srand sscanf strchr strcmp _mbscpy strerror strncmp strncpy strrchr strstr strtol strtoul time tolower wcstombs

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASetLastError WSAStartup __WSAFDIsSet bind closesocket connect gethostbyname getpeername getsockname getsockopt htons ioctlsocket htons recv select send setsockopt socket

Sharing