▲ 3 r/hyperoptic
3 days with no internet
West Reading - 3 days with barely any update, the engineer should have been here yesterday with no improvments.
u/pygaiwan — 10 days ago
Analysis of VIPKeyLogger
Hey everyone,
I just added a new sample to my blog https://www.malwarelearn.com/reports/encryptedps1 .
It is an analysis of a powershell script which drops two separate payloads:
- A new powershell
- an highly obfuscated dll
The secondary powershell file execute the DLL via reflective code loading which in turns uses process hollowing to execute an infostealer hiding inside the .NET compiler.
There is also a separate section on process hollowing https://www.malwarelearn.com/learn/process_hollowing
Any feedback welcome!
u/pygaiwan — 2 months ago