Keylogger Malware Analysis

Keylogger Malware Analysis

by John Hammond

Applied Sciences & Engineering Computing & Cybersecurity URComputer securityURWSpyware
🎙 John Hammond 👥 2.2M 📅 November 25, 2025 ⏱ 16 min 👁 28K 📄 tutorial 🧭 2026-08-16
Available in: English (current) Français

Keywords

keyloggerPowerShellmalware analysisC2exfiltration

Summary

In this video, John Hammond analyzes a PowerShell-based keylogger malware sample. He begins by decoding a Base64-encoded payload to reveal the underlying PowerShell script. The script defines parameters for server and proxy addresses, uses C# code to import Windows API functions, and includes functions for taking screenshots, encoding data, executing commands, and gathering system information. The keylogger functionality captures keystrokes and saves them to a file in the temporary directory. The malware establishes a connection to a command-and-control server and can receive commands to perform actions like uploading files or taking screenshots. Hammond then demonstrates how to use the LetsDefend platform to analyze the malware in a simulated SOC environment, answering questions about the script’s behavior. The video serves both as a malware analysis tutorial and a promotion for LetsDefend’s training services.

132 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video provides a clear and practical demonstration of analyzing a real malware sample, which is valuable for learners. The argumentation is straightforward, based on direct observation of the code, and the explanations are accurate. However, the analysis is not exhaustive; it focuses on the main functionalities without delving into deeper technical details or potential evasion techniques. The promotional aspect for LetsDefend is integrated but does not overshadow the technical content.

Scientific Rigor, Source Quality, Title Accuracy

The video is scientifically sound in its technical explanations, and the analysis is based on the actual code. The sources cited are primarily the LetsDefend platform and affiliated links, which are relevant to the context. The title accurately reflects the content. No comments were provided, so no analysis of public reception is included.

139 words

Title / Content Match

The title accurately reflects the content, which is a detailed analysis of a keylogger malware sample.

Quality & Reliability

7/10

The video provides a practical walkthrough of analyzing a PowerShell keylogger, with clear explanations of the code and its functions. The analysis is accurate and based on direct observation of the sample. However, the video is primarily a promotional tutorial for a training platform, and the depth of analysis is limited to a surface-level review.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • LetsDefend — Platform used for the malware analysis lab and training.
  • Just Hacking Training — Training platform mentioned for cybersecurity courses.
  • CodeCrafters — Affiliate link for coding education.
  • CyberDefenders — Blue team training and SOC analyst certifications.
  • OpenVPN — Affiliate link for VPN hosting.
  • Newsletter — John Hammond's newsletter for updates.

Concurring Sources

  • LetsDefend — The platform provides the malware sample and lab environment, aligning with the video's content.

Contribution & Novelties

The video provides a practical, hands-on demonstration of analyzing a PowerShell keylogger, which is valuable for beginners in malware analysis. It bridges the gap between theoretical knowledge and real-world application by using a real sample and a simulated SOC environment. The walkthrough of the LetsDefend platform adds an educational component that encourages active learning.

Pour aller plus loin :

  • PowerShell documentation — Official documentation for PowerShell, useful for understanding the scripting language used.
  • Windows API — Reference for Windows API functions, relevant to the API imports in the malware.
  • Tor Project — Information about Tor and onion routing, relevant to the malware’s use of a proxy.

106 words

Radar Profile

The radar profile shows a balanced distribution across the four dimensions, with slightly higher scores in quality of information and reliability, reflecting the accurate and practical nature of the analysis. The quantity of information is moderate, and the technical level is appropriate for the target audience.

Reliability 7/10