Extracted

• • Target
    2026-08-30_b49a7dfda226eb6ac08e02fb384fec50_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 203KB
  • SHA256 91057e41cb734712b75b4b54c90f5411a6aa4555c47a5e97b07e4c268694996a
  • MD5 b49a7dfda226eb6ac08e02fb384fec50
  • SHA1 6a91a98e1595d2a1b8abb4ae89da0a2e0971fa5f
  • SHA512 d29db6bac97ec9e4db290fd334d30bb6f4ede037a45ef0699bbb1a1af6bf5cb9e32da02f6eef2dd09034a8e5f675f5097fd9b4816110029ce19d193f1e38f93d
  • SSDEEP 6144:9DKW1Lgbdl0TBBvjc/n1Gc7x5x8N7LCikbL:1h1Lk70TnvjcgKx5aN7cL
  • TLSH
    T1D914AE2175C1C1B3D4B7047045E6CB7A9A7A30720B6A95D7B7DC27BA6F203E1A3362C9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryvipkeyloggerkeyloggerstealercollectionspyware

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information steale

  • Detects executables using Telegram Chat Bot

  • Detects executables with potential process hoocking

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2