K7Labs Details VIP_Keylogger’s In-Memory Delivery and Data Theft

Mar 6, 2026 · Original article ↗

Summary

K7Labs analyzed two VIP_Keylogger delivery chains: spear-phishing RAR attachments lead to in-memory loading via steganography and process hollowing or AES decryption and CLR. The keylogger steals browser, email and app credentials and supports several exfiltration paths

Key points

K7Labs found spear-phishing emails using RAR attachments to deliver an executable that loads VIP_Keylogger in memory; campaign samples showed packaging and execution variations and targeted multiple countries.
One chain hides DLLs and a PNG payload using steganography, then uses process hollowing to execute the keylogger.
A second chain decrypts an AES-encrypted payload in memory, patches AMSI and ETW, and loads VIP_Keylogger through CLR.
The keylogger collects browser-stored credentials and artifacts, email account credentials, Discord tokens, and FileZilla and Pidgin account data.
The malware supports FTP, SMTP, Telegram, HTTP POST, and Discord exfiltration. K7Labs observed SMTP use; other listed channels lacked proper URLs or inputs in the analyzed sample.
K7Labs reported C2 indicators including varders[.]kozow[.]com, aborters[.]duckdns[.]org, and anotherarmy[.]dns[.]army. Some described features, including keylogging and screenshot capture, were not executed in the analyzed build.

Article Details

Attack Vectors: Spear-phishing emails persuade recipients to open a RAR attachment containing an executable disguised as a purchase order.
The executable loads VIP_Keylogger in memory. One analyzed variant hides DLLs and a PNG payload using steganography and performs process hollowing; another decrypts an AES-encrypted payload in memory and loads it using CLR.
VIP_Keylogger collects browser-stored credentials and artifacts, email-client credentials, Discord tokens, and FileZilla and Pidgin account data.
The malware supports exfiltration through FTP, SMTP, Telegram, HTTP POST, and Discord. The analyzed sample was observed sending stolen information by SMTP.
Defensive Notes: Use the supplied hashes, C2 domains, and IP address for detection and response.
The article recommends using a trusted security product such as K7 to safeguard enterprise resources.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`aborters[.]duckdns[.]org`	C2 domain listed for the malware.
DOMAIN	`anotherarmy[.]dns[.]army`	Domain listed in the article's C2 indicators.
DOMAIN	`varders[.]kozow[.]com`	C2 domain listed for the malware.
EMAIL	`log@gtpv[.]online`	Recipient account for stolen information sent via SMTP.
EMAIL	`logs@gtpv[.]online`	Sender account observed sending stolen information via SMTP.
IPV4	`51[.]38[.]247[.]67`	IP address listed as an observed C2 host.
MD5	`694c313b660123f393332c2f0f7072b5`	Hash of a malicious sample detected as spyware.
MD5	`d1df5d64c430b79f7e0e382521e96a14`	Hash of a malicious sample detected as a Trojan.
MD5	`e7c42f2d0ff38f1b9f51dc5d745418f5`	Hash of a malicious sample detected as a Trojan.
MD5	`ea72845a790da66a7870da4da8924eb3`	Hash of a malicious sample detected as a Trojan.

MITRE ATT&CK

T1027.009 · Embedded PayloadsOne loader variant concealed DLLs and the final PNG payload in executable resources using steganography.T1055.012 · Process HollowingOne loader variant created a host executable in suspended mode and used process-hollowing APIs to load VIP_Keylogger.T1056.001 · KeyloggingThe payload is identified as a keylogger; the article says its keylogging feature was available but had not been executed in the analyzed build.T1140 · Deobfuscate/Decode Files or InformationAnother variant decrypted an AES-encrypted payload in memory before loading VIP_Keylogger.T1555.003 · Credentials from Web BrowsersThe malware retrieved and decrypted credentials stored by Chromium-based and Firefox-based browsers.T1562.001 · Disable or Modify ToolsThe second variant patched AMSI and ETW after decrypting its payload.T1566.001 · Spearphishing AttachmentThe campaign used spear-phishing emails with a malicious RAR attachment disguised as a purchase order.

Malware

VIP_KeyloggerAn email-based campaign delivers a RAR attachment that unpacks an executable which loads VIP_Keylogger entirely in memory via steganography, AES decryption, and process hollowing or CLR-based loading depending on the

Vendors

K7It is important to use a trusted security product like K7 to safeguard the enterprise resources.

Products