snojan | 203d471c77f72024ed6d63b636ed108355f42be8304fa16a05c8a6de72650a31

General

Target
2026-10-30_4154fb243d5c74e6c8991fc9669bc80f_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 368KB
Sample261101-d26pcatv5m
SHA256 203d471c77f72024ed6d63b636ed108355f42be8304fa16a05c8a6de72650a31
MD5 4154fb243d5c74e6c8991fc9669bc80f
SHA1 1f0664606e9c9d814989aa3b1abbb412bfd33e1d
SHA512 3ea7be12a575751fe682b84dc9ce086cc37cfcce68b78a06453049ff39d757481d96b69a8a639f409904cf836f70968de1db2690671a5f88fc889dca7a1ad271
SSDEEP 6144:NrFZaaZmEJuLDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+u/h1Lk70TnvjcsMxdABSnLHOr26
TLSH
T13184F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

snojan

C2

http://wecan.hasthe.technology/upload

Targets

- Target
  2026-10-30_4154fb243d5c74e6c8991fc9669bc80f_coinminer_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 368KB
- SHA256 203d471c77f72024ed6d63b636ed108355f42be8304fa16a05c8a6de72650a31
- MD5 4154fb243d5c74e6c8991fc9669bc80f
- SHA1 1f0664606e9c9d814989aa3b1abbb412bfd33e1d
- SHA512 3ea7be12a575751fe682b84dc9ce086cc37cfcce68b78a06453049ff39d757481d96b69a8a639f409904cf836f70968de1db2690671a5f88fc889dca7a1ad271
- SSDEEP 6144:NrFZaaZmEJuLDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+u/h1Lk70TnvjcsMxdABSnLHOr26
- TLSH
  T13184F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader snojan upx
- Family: Snojan
  Snojan is a downloader used to drop and execute other malware.
  downloader snojan
- UPX dump on OEP (original entry point)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Snojan

UPX dump on OEP (original entry point)

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2