InfoStealer
VIPKeyLogger - ENCRYPTED.ps1
- Author
- Moise Medici
- Updated
- 09 May 2026 · Completed
- Difficulty
- Easy
- Platform
- Family
- Languages
- MITRE
MITRE ATT&CK
Execution
Command and Scripting Interpreter: PowerShell
ENCRYPTED.ps1 runs the decrypted stage 2 script through a randomly chosen vector: [scriptblock]::Create, a temporary .ps1 called with &, or powershell -EncodedCommand with -NoProfile -ExecutionPolicy Bypass.Stealth
Obfuscated Files or Information
The process hollowing DLL
MAFFIA.dll is heavily obfuscated, with random member names such as ktdrUh2DgZ4T5U1uxA, unprintable parameter names and switch-based control flow in Execute, which made static deobfuscation impractical.Obfuscated Files or Information: Dynamic API Resolution
MAFFIA.ProcessHollowing declares only LoadLibraryW and GetProcAddress and resolves the other APIs it needs at runtime, turning the returned addresses into callables with Marshal.GetDelegateForFunctionPointer.Obfuscated Files or Information: Embedded Payloads
stage2.ps1 carries both later stages inside itself: MAFFIA.dll as a Base64 string in decodedAssemblyBytes and the Remington.exe stealer as a decimal byte array in ExecutionPayload.Obfuscated Files or Information: Command Obfuscation
One of the stage 1 execution vectors re-encodes the decrypted script to Base64 and hands it to a child
powershell -EncodedCommand, so the command line never shows the script text.Obfuscated Files or Information: Encrypted/Encoded File
ENCRYPTED.ps1 stores stage 2 as Base64 fragments in $CipherMatrix, AES-256-CBC encrypted with a hardcoded key and IV, and Remington.exe keeps its SMTP and Telegram settings as Base64 DES-ECB ciphertext.Process Injection: Process Hollowing
MAFFIA.ProcessHollowing.Execute hollows C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe and runs Remington.exe inside it; dynamic testing shows a private RWX region at 0x400000 starting with an MZ header.Indicator Removal: File Deletion
When the temporary file vector is picked, stage 1 writes the script to a
GetTempFileName() path ending in .ps1, runs it, then deletes it with Remove-Item $tempFile -Force.Deobfuscate/Decode Files or Information
Stage 1 rebuilds
$CipherMatrix with FromBase64String and decrypts it through Aes.CreateDecryptor(); stage 2 decodes the embedded PEs, and COVID19.DES_Decrypt decrypts config strings at runtime with an MD5-derived key.Virtualization/Sandbox Evasion: System Checks
COVID19.AntiBot checks the public IP held in TheInfo against 89.208.29.130, 69.55.5.249, 141.226.236.91 and 3.23.155.57; on a match it sets BotDetected and AntiBotStart sends nothing.Reflective Code Loading
Invoke-ManagedAssembly loads MAFFIA.dll from a byte array with [System.Reflection.Assembly]::Load and calls MAFFIA.ProcessHollowing.Execute through reflection, so the DLL never touches disk.Credential Access
Steal Web Session Cookie
VIPSeassion.Cookies_Chrome reads the cookies table of Chrome’s Default\Network\Cookies database and decrypts encrypted_value with the Local State master key or DPAPI, collecting the results in COVID19.allCookies.Unsecured Credentials: Credentials In Files
COVIDSTPidgin parses the password elements of %AppData%\.purple\accounts.xml, and COVIDSTDiscord carves the Discord token out of the .ldb files in discord\Local Storage\leveldb.Unsecured Credentials: Credentials in Registry
GetOutlookPasswords reads the IMAP Password, POP3 Password, HTTP Password and SMTP Password values under HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 and older profile paths, decrypting them with ProtectedData.Unprotect.Credentials from Password Stores: Credentials from Web Browsers
COVIDSTChrome decrypts the logins table of Chrome’s Login Data with the master key or DPAPI, and VIPF_Based.COVIDSTFireFox decrypts Firefox logins.json entries through nss3.dll PK11SDR_Decrypt.Discovery
System Network Configuration Discovery
COVID19.IPLogger fetches the host’s public IP address from http://checkip.dyndns.org/ with a WebClient and strips the surrounding HTML, feeding the geolocation lookup and the anti-bot check.System Owner/User Discovery
The stealer tags every outgoing log with the victim’s
Environment.UserName, in the VIP Recovery header line of the data and in the SMTP subject and Telegram caption.System Information Discovery
Stage 1 checks
$env:PROCESSOR_ARCHITECTURE before decrypting, and Remington.exe reads the computer name (Environment.MachineName, MyProject.Computer.Name) for the ClickINFO report and the FTP upload file names.Browser Information Discovery
VIPSeassion pulls browsing history (urls), download records (downloads) and top sites (top_sites) from Chromium profile databases, which Once_History_Sender, Once_Downloads_Sender and Once_TopSites_Sender then send out.System Location Discovery
COVID19.TheCountryNameInfo sends the public IP to https://reallyfreegeoip.org/xml/ and reads the CountryName element of the XML reply into the ClickINFO victim summary.Collection
Data from Local System
VIPSeassion reads autofill entries (autofill name and value) and saved payment cards (credit_cards name, encrypted number and expiry) from browser databases, sent by Once_AutoFill_Sender and Once_CreditCard_Sender.Exfiltration
Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
Logs go to
log@htcp.homes by SmtpClient through hosting2.ro.hostsailor.com:587 (TLS only if SslSlate is True), and to a plain HTTP POST at http://51.38.247.67:8081/_send_.php?L or FTP STOR uploads when those senders are enabled.