ctrlINT What the industry said about every indicator, with the quote

VIP KeyloggerMalware

Last reported 3 months ago, by Fortinet Threat Research1 report

ATT&CK techniques

3 techniques · each with the sentence it comes from
  1. T1036Masquerading

    “To evade detection, the actor employs multi-layered, highly obfuscated stages, including extensive junk code and an AutoIt/Lua loader masquerading as a TrueType Font (.ttf) file.”

    Fortinet Threat ResearchVendor
  2. T1053.005Scheduled Task

    “…YESSSSSSSS.' If both conditions are met, the script copies itself to the %PUBLIC%\Libraries folder and establishes persistence via a Scheduled Task.”

    Fortinet Threat ResearchVendor
  3. T1055Process Injection

    “It then locates a local data file, decrypts it using XOR, and finally uses low-level ntdll.dll functions to perform process injection and execute the payload.”

    Fortinet Threat ResearchVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “Additionally, we acquired a Snake VIP Keylogger builder and used it to generate both protected and unprotected versions of the payload for comparative analysis, shown in Figure 24.”

    Fortinet Threat ResearchVendor
    The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with VIP Keylogger here?
No account needed. We do not store your IP address.