Extracted

• • Target
    2026-10-15_3e8d737f7ebaf2c534fc54e980410d8a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 203KB
  • SHA256 b7ac96938b5e483df3dbfeb60d5b1f3a84605a3f00eedb5cd661604ce935507f
  • MD5 3e8d737f7ebaf2c534fc54e980410d8a
  • SHA1 7bd0f650c524ca8e274d452250b3cd275ed48cdf
  • SHA512 3483a9bdd602add66138464198791d215a8bf6a5914f5b512c3186543486d9576c57025d63c2fe3e2b3a203553b6d1a007e19f159ad5cdb6ee6e8e92a63092cc
  • SSDEEP 3072:rDKW1LgppLRHMY0TBfJvjcTp5X1i1asb0snmmWo17bYg:rDKW1Lgbdl0TBBvjc/1mAsmOVbx
  • TLSH
    T1C214BF2171C1C2B2D4B7107484E6CB7A9A3A3071077A96D7B6DD17BA6F213E1A3362CD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryvipkeyloggerkeyloggerspywarestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information steale

  • Detects executables using Telegram Chat Bot

  • Detects executables with potential process hoocking

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2