malwarelearn
Home Learn Reports Tools Tags About
← Reports

InfoStealer

VIPKeyLogger - ENCRYPTED.ps1

Author
Moise Medici
Updated
09 May 2026 · Completed
Difficulty
Easy
Platform
Windows
Capabilities
Dropping Secondary PayloadsProcess Hollowing
Tags
ps1C#VIPKeyLogger

Appendix

  • 1 ↩ CyberChef: CyberChef
  • 2 ↩ Microsoft: about_Operators
  • 3 ↩ Microsoft: about_Profiles
  • 3 ↩ Microsoft: about_Execution_Policies
  • 4 ↩ Microsoft: about_script_blocks
  • 5 ↩ Microsoft: Assembly.GetType Method
  • 6 ↩ Microsoft: Delegates (C# Programming Guide)
  • 7 ↩ Microsoft: Marshal.GetDelegateForFunctionPointer Method
  • 8 ↩ RedTeamLeaders: Chrome Password Dumper: Guide to Browser Password Recovery
  • 9 ↩ Wikipedia: Data Protection API
  • 10 ↩ Microsoft: ProtectedData.Unprotect Method
  • 11 ↩ Microsoft: Introduction to lock files (laccdb and ldb) in Access
  • 12 ↩ Microsoft: NewLateBinding.LateGet Method
  • 13 ↩ Microsoft: WebRequest.Create Method
  • 14 ↩ Solarwinds: FTP Commands: APPE, MLSD, MLST, LIST, RETR, STOR, STOU
  • 15 ↩ Mozilla Support: Missing mozglue.dll when launching Firefox
  • 16 ↩ Firefox Source Docs: Introduction to Network Security Services
  • 17 ↩ pk11sdr.h: pk11sdr.h Source Code
  • Section 12 of 12: Appendix
    ← Indicators of Compromise
    Q1What is the content of CipherMatrix?Q2What is the content of tempFile?Q3What is the content of decodedAssemblyBytes?Q4What is the content of ExecutionPayload?Q5What is the content of the executable file coming from decodedAssemblyCode, stage3.exe?Q6What is MAFFIA.ProcessHollwing?Q7What is the content of the executable file coming from ExecutionPayload, invocationParam.exe?Q8Is it possible to let the decodedAssemblyBytes DLL perform the process hollowing on a custom payload?

    ○ open✓ answered– not raised yet

    On this page

    File InfoPowershell Code AnalysisQuestion 1: What is the content of `CipherMatrix`?Question 2: What is the content of `tempFile`?Question 3: What is the content of `decodedAssemblyBytes`?Question 4: What is the content of `ExecutionPayload`?.NET Code and Dynamic AnalysisQuestion 5: What is the content of the executable file coming from `decodedAssemblyCode`, `stage3.exe`?Question 8: Is it possible to let the `decodedAssemblyBytes` DLL perform the process hollowing on a custom payload?Question 7: What is the content of the executable file coming from `ExecutionPayload`, `invocationParam.exe`?Indicators of CompromiseAppendix

    Type to search every report and article.