In the past few years, the threat landscape has shifted dramatically, keyloggers and information stealers have become one of the most actively developed and deployed malware payloads. Whether acting as standalone threats or as loaders to facilitate broader attacks, these tools are designed to harvest sensitive data with alarming efficiency. VIP Keylogger is one such example of this active threat.

VIP Keylogger continues to demonstrate high resilience, leveraging common but effective phishing campaigns and evasion techniques to bypass security controls. In this post, the Splunk Threat Research Team (STRT) provides a comprehensive analysis of the VIP Keylogger malware family, alongside a deep dive into its script loader’s use of obfuscation and steganography. We will discuss the specific tactics and techniques extracted during our research, helping you develop robust Splunk detections to identify these threats and improve your proactive threat-hunting efforts.

Loader Analysis:

During our recent research, the Splunk Threat Research Team (STRT) observed that VIP Keylogger campaigns have relied heavily on social engineering over the past few months. Attackers are masquerading as legitimate business communications such as bank payment notifications, procurement orders, and logistics updates to lure users into opening malicious files. While these phishing tactics are not new, they remain remarkably effective at tricking targets into executing the initial loader, which then kicks off the entire infection chain.

To better understand these delivery methods, STRT collect 200+ random VIP script loader samples captured between March and April 2026. Figure 02 illustrates the commonalities in how these loaders are named, based on data sourced from VirusTotal. By examining these naming conventions, we can gain better insight into the attackers' strategies in these phishing campaigns.

In the following sections, the STRT will analyze the three most common script loader file types used by VIP Keylogger (.vbs, .js, and .bat) to deliver its payload. We will break down how these loaders maximize obfuscation and employ multi-component strategies. Furthermore, we will explore the malware’s use of steganography, where the malicious stager is hidden within legitimate image file format to evade static detection.

Visual Basic: T1059.005

The first loader of interest is the variant of malicious .vbs script, which incorporates extensive junk code at both the beginning and the end of the file to evade detection.

Figure 03 illustrates this technique, showing how the junk code is used to obfuscate the actual malicious payload, which remains embedded in the middle of the file.

Figure 04 displays the cleaned version of one of the samples STRT analyzed. We can observe that the large hex-encoded string is decoded to recover the next stager, a PowerShell script relative to the PowerShell execution policy defined within one of its variables.

PowerShell: T1059.001

Beyond the PowerShell stager, STRT observed another interesting technique: the decoded PowerShell script is written to the INTERNAL_DB_CACHE user environment variable. This script is stored temporarily before execution and then deleted, a tactic likely designed to minimize the malware's footprint on the host as illustrated in Figure 05.

While this is a stealthy location to hide malicious code, the artifact can be effectively detected by monitoring registry modifications in HKCU\Environment. Even if the malware attempts to clean up its tracks by deleting the variable after execution, the initial creation or update of this registry key serves as a clear, detectable event for security teams to capture.

Steganography: T1027.003

The PowerShell stager continues the infection chain by downloading two image files. Although these files use the .png extension, they are leveraged as containers for obfuscated data. As shown in Figure 05, the first URL (hxxps://vault88x[.]secure-efficient2[.]su/MSI_105759[.]png) contains the encoded downloader component. This component subsequently fetches the second file (hxxps://vault88x[.]secure-efficient2[.]su/img_085027[.]png), which houses the encoded final payload in this instance, the VIP Keylogger.

The decoding of the payload in both steganography image file is quite simple. Figure 09 shows the stages of the script STRT developed to extract the final payload. The steps are:

1. it looks for the marker "IN-" as starting point of encoded data and "-in1"
2. replace the "#" with "A" that hides the base64 encoded data from common base64 static detection pattern.
3. reverse it, then base64 decode.

The algorithm is the same as the 2nd .png steganography component with a different base64 starting marker.

JavaScript: T1059.007

Another prominent VIP Keylogger loader variant utilizes a heavily obfuscated .js script, as illustrated in Figure 10. The primary objective of this obfuscation is to hinder analysis while the script fetches the next stage of the infection: a PowerShell stager.

Encrypted/Encoded File: T1027.013

The next stager is PowerShell that will decode and decrypt the third stager using base64 decoding and AES decryption algorithm as illustrated in Figure 11. The decrypted data is more PowerShell that will set up the final loader execution.

Reflective Code Loading: T1620

The third stager PowerShell script proceeds to decrypt and decode two PE executables. The first is a .NET module designed to inject the second executable, the VIP Keylogger, into a legitimate aspnet_compiler.exe process using “Invoke-AssemblyExecution” Function. By targeting this executable, a standard .NET utility, the malware blends in with legitimate system activity, effectively concealing the malicious payload from the user.

Windows Command Shell: T1059.003

Next up is the third VIP Keylogger loader, a clever .bat script variant. It hides a PowerShell stager right beneath its primary code, marked by the identifier 'REM_IT5kbjeaDNbs.' When triggered, the script decodes this payload and drops it as a hidden file in the '%appdata%\Microsoft\Windows\Libraries' folder.

Logon Script: T1037.001

The loader doesn’t just run and disappear it’s built to stay. It secures persistence by hijacking the “UserInitMprLogonScript” registry key. By planting its file path here, the malware ensures it’s triggered automatically every time the user logs in, making it a persistent threat from the moment the desktop loads.

The second PowerShell stager decodes and decrypts a large chunk of Base64-encoded data using a simple XOR routine. However, the XOR key itself is protected with AES encryption, adding an extra layer of obfuscation.

What makes this stage particularly interesting is its use of embedded .NET code, which is compiled on the fly via PowerShell’s “Add-Type -TypeDefinition” command. This inline .NET component is specifically designed to execute the decrypted shellcode, which in turn handles the decryption and execution of the final payload VIP Keylogger.

VIP Keylogger Analysis:

Below, STRT breaks down the MITRE ATT&CK tactics and techniques uncovered in the VIP Keylogger payload extracted from the Script Loader analyzed earlier.

System Information Discovery: T1426

As part of its C2 beaconing process, VIP Keylogger collects extensive system metadata, including the hostname, IP address, country, geolocation, and other identifying details as shown in Figure xx. To retrieve network and location data, the malware queries public web services, specifically hxxps[:]//reallyfreegeoip[.]org/xml/ and hxxp[:]//checkip[.]dyndns[.]org/."

Virtualization/Sandbox Evasion: System Checks: T1497.001

As shown in Figure 16, VIP Keylogger uses evasion tactics to stay under the radar. It cross-references the host's IP address against a predefined list of bot-related IPs and checks for the 'WALKER' hostname both of which are clear indicators that the malware is being analyzed in a sandbox.

Indicator Removal: File Deletion: T1070.004

Figure 17 shows the renamed function, smethod_15(), which launches a hidden command prompt to delete the currently running executable before immediately terminating the process. Additionally, the method employs a time-based delay technique using choice.exe to postpone the self-deletion routine for 3 seconds.

Credentials from Web Browsers: T1555.003

VIP Keylogger maintains an extensive list of targeted browsers and applications to harvest sensitive data from compromised systems.

Once executed, the malware attempts to extract a wide range of information from installed browsers, including saved passwords, cookies, download records, browsing history, credit card details, autofill data, and frequently visited sites (Top Sites). By leveraging the common data storage structure used by Chromium-based browsers, the malware can systematically parse these databases and retrieve valuable credentials.

In addition to browser data, VIP Keylogger also targets application-specific storage. For example, it scans known database locations such as the Discord Local Storage, enabling it to steal authentication tokens that can be used to hijack user sessions without requiring the victim’s password.

Clipboard Data: T1115

Figure 18 illustrates the method of this malware that implements clipboard hijacking. This routine reads clipboard content using Clipboard.GetText(). and uses regex to scan for cryptocurrency wallet addresses, including Bitcoin, Monero, Stellar, Ethereum, Ripple, Litecoin, Bitcoin Cash, NEO and DASH. If a match is found, the malware silently replaces the address with one controlled by the attacker.

Input Capture: Keylogging: T1056.001

True to its name, VIP Keylogger is designed to capture every keystroke, potentially intercepting sensitive information like user credentials. Figure 19 pulls back the curtain on the code, illustrating exactly how the malware hooks into system events to execute its data-collection routine.

Service Stop: T1489

To ensure a smooth extraction of sensitive data, VIP Keylogger proactively kills active browser processes, preventing file locks and errors during the database parsing phase.

Credentials in Registry: T1552.002

VIP Keylogger doesn't stop at keystrokes; it also mines the system registry for sensitive data. Figures 21 and Figure 22 reveal the code used to extract Outlook credentials and the system Product ID directly from the registry.

Screen Capture: T1113

To gain deeper visibility into the victim's activity, the malware periodically takes screenshots of the desktop. These images are silently stored as 'Screenshot.png' in the C:\Users\<Username>\Documents\VIPREcovery folder, allowing the attacker to exfiltrate visual data from the compromised system.

Wi-Fi Discovery: T1016.002

By leveraging the built-in Windows utility netsh.exe, VIP Keylogger enumerates all Wi-Fi networks previously connected to the system using the command “netsh wlan show profile”. It then follows up by executing “netsh wlan show profile name=<WiFi name> key=clear”, allowing it to extract the corresponding Wi-Fi passwords in plaintext. This enables the malware to harvest network credentials and potentially gain access to other systems within the same network.

Web Protocols: T1071.001

VIP Keylogger leverages multiple command-and-control (C2) servers to exfiltrate data collected from compromised hosts. Figure 24 highlights several C2 URLs identified in a VIP Keylogger sample analyzed by STRT, revealing the use of a Telegram bot, dedicated C2 infrastructure, and even reused C2 servers previously observed in other malware campaigns.

Detections:

Logon Script Event Trigger Execution

The following analytic detects the modification of the UserInitMprLogonScript registry entry, which is often used by attackers to establish persistence and gain privilege escalation upon system boot.

PowerShell Environment Variable Execution

The following analytic detects the execution of PowerShell scripts that combine environment variable access (`$env:` or`[Environment]::SetEnvironmentVariable`) with `Invoke-Expression` or its alias `iex` to dynamically construct and run code at runtime.

Windows Anomalous Registry Value Length in Environment Key

The following analytic detects creation or modification of registry values under a user or system Environment key (paths matching *\Environment\*) where the stored value exceeds 2,000 characters.

Windows Proxy Execution of .NET Utilities via Scripts

The following analytic detects the launch of common .NET-related utilities—aspnet_compiler.exe, msbuild.exe, regasm.exe, InstallUtil.exe, or vbc.exe when the parent appears to be a script (batch, CMD, PowerShell, JScript, VBScript, or HTML) running from an unusual or user-writable Windows location (for example Public, Temp, Fonts, Debug, Recycle Bin, Prefetch, or similar paths), and the child process shows little or no command-line variation from the image path or name.

Windows Gather Victim Network Info Through Ip Check Web Services

The following analytic detects processes attempting to connect to known IP check web services.

Windows Credentials from Password Stores Chrome Login Data Access

The following analytic identifies non-Chrome processes accessing the Chrome user data file "login data".

Executables Or Script Creation In Suspicious Path

The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems.

Windows DNS Query Request by Telegram Bot API

The following analytic detects the execution of a DNS query by a process to the associated Telegram API domain, which could indicate access via a Telegram bot commonly used by malware for command and control (C2) communications.

PowerShell P/Invoke Process Injection API Chain

The following analytic detects PowerShell Script Block Logging (Event ID 4104) evidence of a complete P/Invoke process-injection API chain at either the compile phase or the execution phase.

Overall VIP Keylogger Analysis Story consist of 26 Splunk detections.

IOC:

Learn More

This blog aims to help security analysts, blue teamers, and Splunk users identify VIP Keylogger activity by providing insights into the tactics, techniques, and procedures (TTPs) employed by threat actors. You can implement the detections in this blog using the Enterprise Security Content Updates app or the Splunk Security Essentials app. To view the Splunk Threat Research Team's complete security content repository, visit research.splunk.com.

Feedback

Any feedback or requests? Feel free to put in an issue on Github and we’ll follow up. Alternatively, join us on the Slack channel #security-research. Follow these instructions If you need an invitation to our Splunk user groups on Slack.

Contributors

We would like to thank Teoderick Contreras for authoring this post and the entire Splunk Threat Research Team for their contributions: Bhavin Patel, Rod Soto, Patrick Bareiss, Raven Tait, AJ King , Nasreddine Bencherchali and Lou Stella.