snojan | 498005dbaa99578e75b8f4e25686682f55849c0afe289602dd9923cc6d0574c0

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_7253da23ae95253724dbe411c88957be_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 275KB
Sample261022-1l4alsbf37
SHA256 498005dbaa99578e75b8f4e25686682f55849c0afe289602dd9923cc6d0574c0
MD5 7253da23ae95253724dbe411c88957be
SHA1 7a38f444c43049b2b1b0e9eecb4bef9bfe7ff05a
SHA512 11a0ad907bd109704d838c71dfb569356f25770cdcb0ace099d6bccb07bf7713b39e6db0674061bf74ecfcd167a85a3b35c2dfe605eb62b15fea25f6c95044f9
SSDEEP 6144:2DeM7iNEkgiOb31k1ECnJjPDKW1Lgbdl0TBBvjc/YVMt:2De3jgR19Cn5Lh1Lk70TnvjcsMt
TLSH
T162548D20B580D0F3D8B301B145859B755E35E835072AC6C3F3D9AFBA6E60391A7693EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader snojan

Malware Config

Extracted

Family

snojan

http://wecan.hasthe.technology/upload

Signatures

Family: Snojan
Snojan is a downloader used to drop and execute other malware.
downloader snojan

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-21_7253da23ae95253724dbe411c88957be_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-21_7253da23ae95253724dbe411c88957be_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_7253da23ae95253724dbe411c88957be_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-21_7253da23ae95253724dbe411c88957be_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_7253da23ae95253724dbe411c88957be_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-ADsykp9wZG2aOb46.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-ADsykp9wZG2aOb46.exe
Size 275KB
SHA256 9c283db858eae836b0fd86c9fce63d6bd6d87786ce9a481b99d1519e5911decc
MD5 8b311c5957b7491d40b4aa5843280dbb
SHA1 5f465d161a14a4d93614eb8ca0567181117c8321
SHA512 d25860408b9861a34ecdf7d39a2a11457f10212a795c1df2689f2c09d72be4e7dfa00bc7ad7ce2331739cc791768e2f330d0ac061ac673d539828fa13fdafea2
SSDEEP 6144:2DeM7iNEkgiOb31k1ECdJjPDKW1Lgbdl0TBBvjc/YVMt:2De3jgR19Cd5Lh1Lk70TnvjcsMt
TLSH
T10E548D20B580D0F3D8B301B145859B755E35E835072AC6C3F3D9AFBA6E60391A7693EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download