snojan | 6dfec8465df214cca1806b741f92b1f2334f42ce035715569046da248377515b

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/10/2026, 12:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_9a0412f16c79f3f394e1814a64dc7573_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 255KB
Sample261031-pwcd4axsbx
SHA256 6dfec8465df214cca1806b741f92b1f2334f42ce035715569046da248377515b
MD5 9a0412f16c79f3f394e1814a64dc7573
SHA1 478d42820cc6211f01abeff91aeae8e00dd15913
SHA512 35d728b448d8211430d461fe9e0af7962a46e9d8e8a158c9b11470afe5911344d411f85cdfd9bfbb82034076d1d992ae3c0e64436b5a0e58dd65952e1ce096d8
SSDEEP 6144:2DeM7iNEkgiOb31k1ECcJjPDKW1Lgbdl0TBBvjo:2De3jgR19Cc5Lh1Lk70Tnvjo
TLSH
T167448D20A580D0F3E8B300B141959B75AE35EC35032ADAC7E3D5AFB56D60391E7693EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader snojan

Malware Config

Extracted

Family

snojan

http://wecan.hasthe.technology/upload

Signatures

Family: Snojan
Snojan is a downloader used to drop and execute other malware.
downloader snojan

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-31_9a0412f16c79f3f394e1814a64dc7573_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-31_9a0412f16c79f3f394e1814a64dc7573_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_9a0412f16c79f3f394e1814a64dc7573_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-31_9a0412f16c79f3f394e1814a64dc7573_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_9a0412f16c79f3f394e1814a64dc7573_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-ab7b6nvyZD1zeJWv.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-ab7b6nvyZD1zeJWv.exe
Size 255KB
SHA256 5bbc2e9b8d598f7c94e2a1de3025f09004292965baecbcb40c15901c0dfcc35f
MD5 316c175b4e3a12ba0c97efbd049de40f
SHA1 154fed34fd7828703190c8f32efdf14a857d2c51
SHA512 2bc9cad7554ef745a50eb7faa2645c5b63e0f49a7c1bdc4739f8bee5cc26234a5bc230712fbd0a2069c410aa6f472f27706d72e7dd616f0ff9d73599b9592a2e
SSDEEP 6144:2DeM7iNEkgiOb31k1ECxJjPDKW1Lgbdl0TBBvjo:2De3jgR19Cx5Lh1Lk70Tnvjo
TLSH
T18B448D20A580D0F3E8B300B141959B75AE35EC35032ADAC7E3D5AFB56D60391E7693EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download