← Reports

InfoStealer

VIPKeyLogger - ENCRYPTED.ps1

Author
Moise Medici
Updated
09 May 2026 · Completed
Difficulty
Easy
Platform
Windows
Capabilities
Dropping Secondary PayloadsProcess Hollowing
Tags
ps1C#VIPKeyLogger

Indicators of Compromise

Network

  • hosting2.ro.hostsailor.com:587 email exfiltration over SMTP
  • http://51.38.247.67:8081/

Hashes · SHA-256

  • 81278323333366c9177d761e8bf94c4664d06447198af84cb45f0fa5796e523f stage1.ps1
  • 201cf13f46b08feb07913ea61c0b1ad560accbd566697d5ec8f0182756e42aee stage2.ps1
  • d945151ed42fada60086a9730d57d524a6b973716d752a85cdc75b14ee0742b1 stage3.exe
  • 44f92c25d4d71cd0848fdd7e79ac36d779480da454ef0c9a44ced7f4aea16dcc invocationParam.exe