malwarelearn
Home Learn Reports Tools Tags About
← Reports

InfoStealer

VIPKeyLogger - ENCRYPTED.ps1

Author
Moise Medici
Updated
09 May 2026 · Completed
Difficulty
Easy
Platform
Windows
Capabilities
Dropping Secondary PayloadsProcess Hollowing
Tags
ps1C#VIPKeyLogger

.NET Code and Dynamic Analysis

Section 7 of 12: .NET Code and Dynamic Analysis
← Question 4: What is the content of `ExecutionPayload`? Question 5: What is the content of the executable file coming from `decodedAssemblyCode`, `stage3.exe`? →
Q1What is the content of CipherMatrix?Q2What is the content of tempFile?Q3What is the content of decodedAssemblyBytes?Q4What is the content of ExecutionPayload?Q5What is the content of the executable file coming from decodedAssemblyCode, stage3.exe?Q6What is MAFFIA.ProcessHollwing?Q7What is the content of the executable file coming from ExecutionPayload, invocationParam.exe?Q8Is it possible to let the decodedAssemblyBytes DLL perform the process hollowing on a custom payload?

○ open✓ answered– not raised yet

On this page

File InfoPowershell Code AnalysisQuestion 1: What is the content of `CipherMatrix`?Question 2: What is the content of `tempFile`?Question 3: What is the content of `decodedAssemblyBytes`?Question 4: What is the content of `ExecutionPayload`?.NET Code and Dynamic AnalysisQuestion 5: What is the content of the executable file coming from `decodedAssemblyCode`, `stage3.exe`?Question 8: Is it possible to let the `decodedAssemblyBytes` DLL perform the process hollowing on a custom payload?Question 7: What is the content of the executable file coming from `ExecutionPayload`, `invocationParam.exe`?Indicators of CompromiseAppendix

Type to search every report and article.