← Reports

InfoStealer

VIPKeyLogger - ENCRYPTED.ps1

Author
Moise Medici
Updated
09 May 2026 · Completed
Difficulty
Easy
Platform
Windows
Family
VIPKeyLogger
Languages
PowerShellVB.NET
MITRE
T1059.001 (Command and Scripting Interpreter: PowerShell) T1027 (Obfuscated Files or Information) T1027.007 (Obfuscated Files or Information: Dynamic API Resolution) T1027.009 (Obfuscated Files or Information: Embedded Payloads) T1027.010 (Obfuscated Files or Information: Command Obfuscation) T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File) T1055.012 (Process Injection: Process Hollowing) T1070.004 (Indicator Removal: File Deletion) T1140 (Deobfuscate/Decode Files or Information) T1497.001 (Virtualization/Sandbox Evasion: System Checks) T1620 (Reflective Code Loading) T1539 (Steal Web Session Cookie) T1552.001 (Unsecured Credentials: Credentials In Files) T1552.002 (Unsecured Credentials: Credentials in Registry) T1555.003 (Credentials from Password Stores: Credentials from Web Browsers) T1016 (System Network Configuration Discovery) T1033 (System Owner/User Discovery) T1082 (System Information Discovery) T1217 (Browser Information Discovery) T1614 (System Location Discovery) T1005 (Data from Local System) T1048.003 (Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol) T1567 (Exfiltration Over Web Service)

Question 4: What is the content of ExecutionPayload?

Before moving to the analysis of stage3.exe, the content of ExecutionPayload can be found without even having to use any breakpoint. Note the start of the array of numbers: it is 77 90, which is the same as stage3.exe, so another executable file. Using the “From Decimal” recipe as before, with the comma delimiter, the whole content of ExecutionPayload can be pasted and saved to file. It has been named invocationParam.exe to remember that it is used as an argument of the stage3.exe.