Hackers Exploit VBScript Files to Deliver Masslogger Credential Stealer Malware

Seqrite Labs security researchers have uncovered a highly sophisticated campaign involving the Masslogger credential stealer, delivered via encoded VBScript files (.VBE).

This latest variant demonstrates advanced fileless malware techniques, leveraging Windows Registry for persistent and covert payload delivery while effectively bypassing traditional antivirus defenses.

The attack typically begins with a .VBE (VBScript Encoded) file distributed through spam emails or drive-by downloads.

Encoded using Microsoft’s built-in encoding scheme, the script is initially opaque to casual inspection.

Upon decoding, analysts found multiple layers of obfuscated routines, designed to evade static analysis and thwart detection.

Registry-Based Payload Staging

Once executed, the decoded VBScript writes several hard-coded, partially obfuscated values to specific registry keys under HKCU\Software\.

These values include PowerShell commands, .NET assemblies for stager deployment, and flags for control flow.

The script’s modular subroutines handle the sequential setup of these registry entries, ensuring the malware’s operation is entirely fileless beyond the initial script.

Before registry modification, the malware probes the presence of MSBuild.exe within the .NET Framework directory to determine which stager version should be deployed.

This conditional logic enhances the campaign’s robustness across various system configurations.

Multi-Stage In-Memory Execution

The malware uses two .NET-based stagers, each loaded directly into memory from the registry.

The first stager is retrieved and executed using obfuscated PowerShell commands that work entirely in-memory, reversing and decoding registry values to reconstruct the binary.

Once loaded, the primary stager fetches a secondary stager, also stored in the registry in a reversed format.

The second stager is responsible for harvesting the full Masslogger payload, which itself is split into numerous registry segments and reassembled by the malware loader.

Persistence is achieved through a scheduled task, named after a created registry key, which executes a monitoring VBS script every minute.

According to Seqrite Blog Report, this script is capable of simulating user input through PowerShell’s SendKeys method, making detection more difficult.

The malware also checks for system protections by enumerating registry locations commonly used by antivirus and security products.

If multiple security solutions are detected, the malware ceases operation, demonstrating a clear attempt to avoid sandboxing and research environments.

A notable feature of this campaign is geo-targeted secondary payload delivery. If the infected system’s input language and locale indicate France, the malware attempts to fetch additional resources from a hardcoded remote URL.

Regardless of location, the final Masslogger payload is injected into a new process via process hollowing, running entirely in memory.

Masslogger is a notorious information stealer, capable of extracting credentials and autofill data from a wide array of web browsers and email clients.

Further functionalities include keylogging, clipboard data theft, screenshot capture, and monitoring window activity.

Collected data is exfiltrated using encrypted channels over FTP, SMTP, or Telegram, depending on the campaign configuration.

This Masslogger variant exemplifies the growing trend of sophisticated, multi-stage, fileless malware.

By leveraging encoded script loaders, memory-only payloads, and deep registry abuse, attackers are able to evade classic endpoint defenses and maintain persistence without leaving conventional forensic footprints.

The advanced use of system scripting and registry manipulation underscores the need for behavioral, rather than solely signature-based, detection mechanisms

Indicators of Compromise (IOC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.