snojan | 5a499217fe403fcfe75f163c3e78192dd597bb619d59c5635f2d2ce3b525b79f

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-17_d337a1655d6f09f62ed4ad522ffaa717_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 255KB
Sample261018-fpndca115j
SHA256 5a499217fe403fcfe75f163c3e78192dd597bb619d59c5635f2d2ce3b525b79f
MD5 d337a1655d6f09f62ed4ad522ffaa717
SHA1 e10c6adbe650b2bab9055d830d75362b9f09254e
SHA512 e9115404a0c4e53f4b475759284bb70732ca2f7765166bcc3784d31db337b5bd551c391da36836e244dfc6d878f9682e9f814224ed1b2054b0f66bff970314d2
SSDEEP 6144:2DeM7iNEkgiOb31k1EC8JjPDKW1Lgbdl0TBBvjo:2De3jgR19C85Lh1Lk70Tnvjo
TLSH
T126448D20A580D0F3E8B300B141959B75AE35EC35032ADAC7E3D5AFB56D60391E7693EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader snojan

Malware Config

Extracted

Family

snojan

http://wecan.hasthe.technology/upload

Signatures

Family: Snojan
Snojan is a downloader used to drop and execute other malware.
downloader snojan

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-17_d337a1655d6f09f62ed4ad522ffaa717_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-17_d337a1655d6f09f62ed4ad522ffaa717_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-17_d337a1655d6f09f62ed4ad522ffaa717_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-17_d337a1655d6f09f62ed4ad522ffaa717_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-17_d337a1655d6f09f62ed4ad522ffaa717_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-4MlTDSrNPCUbtxZb.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-4MlTDSrNPCUbtxZb.exe
Size 255KB
SHA256 2ba4f59fe29b616b705d37b99ba9a72c84559d115fc9a1e914d8f654e08a421e
MD5 1cafbeb51701a796768fd03644a0535f
SHA1 a0d314c5109410d184d057b8d692df1888b22fb2
SHA512 0d6525b68fe2dd3b6d7438b321b4c539c5f00c082b8ddf82423c6c30ec6b702c91aea8b900dac9b54d1c6fbe0c6bebfff8172fd6ecf6398ca7b0f50289f8a770
SSDEEP 6144:2DeM7iNEkgiOb31k1ECGJjPDKW1Lgbdl0TBBvjo:2De3jgR19CG5Lh1Lk70Tnvjo
TLSH
T1A9448D20A580D0F3E8B300B141959B75AE35EC35032ADAC7E3D5AFB56D60391E7693EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download