evacompltd.site: a Windows VIP Keylogger malware site (script files and PowerShell) and what to do if one ran

What evacompltd.site is, and what we know about it

evacompltd.site is a web address, not a program on your PC. It is a domain that the abuse.ch project URLhaus lists as a place where malware was served, and four of its six entries carry the tag VIPKeylogger. No public write-up of this one domain exists that we could find, so this page rests on what URLhaus shows, what we saw ourselves and what the Splunk Threat Research Team has published about VIP Keylogger loaders.

1. 1

   What URLhaus lists

   Six file addresses on evacompltd.site, all added on 29 September 2026 between 07:39 and 07:40 UTC by the abuse.ch reporter account. Three are JavaScript files (ending in .js, with long random names) and three are PowerShell scripts, each named secured_stub.ps1, in the folders /cat/, /mrcat/ and /mrcat29/. All six carry the threat type malware_download and were offline when we read them.

2. 2

   What the tags mean

   ps1 and powershell say a file is a PowerShell script. js says it is a JavaScript file. ascii says it is plain text. opendir says the server showed its folder contents openly, so anyone could list the files. VIPKeylogger names the malware family: VIP Keylogger is a stealer that records keystrokes and takes saved logins. Together they describe script files meant to start a loader chain.

3. 3

   What we could not confirm

   We did not download any of the files and we never saw a page that tells visitors what to do. So we do not know how a victim reached the scripts or what each file does. The tags are the reporter's labels, not our finding.

4. 4

   What this means for you

   If you only saw the name in a log, a link or a warning, you are not infected by that alone. The risk is for people who opened a script file from this address, pasted a command that fetched one, or ran a file that came from it.

Kind of threat

A malware download address; four of six entries are tagged VIPKeylogger

Malware family

VIP Keylogger, a stealer for Windows (reporter's tag, not confirmed by us)

Domain registered

28 September 2026, expires 28 September 2027, registrar Spaceship, Inc.; record last changed 3 October 2026 (RDAP, read 10 October 2026)

URLhaus entries

6 file addresses, all added on 29 September 2026; all 6 offline when we read them

Platform

Windows, by the ps1 tag and the family. No source says which other systems are hit

What we checked on 10 October 2026, and what we could not

We tried to open https://evacompltd.site/ once, from Lithuania, in an automated Chromium browser set to English. The browser reported that the name could not be found, so no page loaded. That tells you nothing good about the site and it clears nothing.

What happened to evacompltd.site, from registration to our test

The history is very short: the domain was reported as a malware source the day after it was registered. The dates come from RDAP and from the URLhaus database.

1. 28 September 2026

   The domain is registered

   RDAP shows evacompltd.site registered on 28 September 2026 through the registrar Spaceship, Inc., valid until 28 September 2027. The name sounds like a company; nothing we found shows a real business behind it.

2. 29 September 2026

   Six script files are reported within two minutes

   Between 07:39 and 07:40 UTC URLhaus receives six entries from abuse.ch: three secured_stub.ps1 scripts and three .js files with long random names, most tagged VIPKeylogger. This is the first time URLhaus sees the host, one day after registration.

   

3. 3 October 2026

   The registration record changes

   RDAP shows the record changed on this date. We do not know what was changed or why.

4. 10 October 2026

   Our test finds no address

   Our browser visit to https://evacompltd.site/ ends in ERR_NAME_NOT_RESOLVED, and URLhaus shows all six files offline.

We could not read the URLhaus pages themselves, because they ask for a browser check. The entries above come from the same data in our own database, which holds the URLhaus feed.

What VIP Keylogger is and how its script loaders work

We did not open evacompltd.site's files. This is how the Splunk Threat Research Team describes more than 200 VIP Keylogger script loaders from March and April 2026, so you can recognise the pattern.

1. 1

   A phishing email delivers a script

   Splunk says the loaders spread through phishing that imitates bank payment notices, purchase orders and shipping updates. The loader may be a .vbs, .js or .bat file. The .js loader is heavily obfuscated and fetches a PowerShell stager, which decodes and decrypts a third one.

2. 2

   The stages hide in a user variable

   The decoded PowerShell is held for a moment in a user environment variable named INTERNAL_DB_CACHE and then deleted. The next stage decodes Base64 data with an XOR key that is itself protected with AES, and compiles inline .NET code to run shellcode.

3. 3

   Pictures can carry the code

   Splunk found PNG files hosted by the attackers that hide the encoded downloader and the stealer. The script cuts the data out between two text markers and decodes it. A .bat loader instead drops its payload as a hidden file in %appdata%\Microsoft\Windows\Libraries.

4. 4

   The stealer runs inside a real program

   The payload is injected into aspnet_compiler.exe, a legitimate Microsoft .NET tool. SOC Prime also names only that process. The loader also checks for sandboxes and deletes itself after running.

5. 5

   A logon value brings it back

   Splunk says the loader sets the UserInitMprLogonScript registry value so that it runs each time the user signs in. This is the part you can look for on a PC.

The six files: what each name suggests, and what we do not know

File names are weak evidence. We list what each one could be and mark which statements are only a reading of the name and tags.

Three folders, each with a ps1 and some with a js, and an open directory listing, suggest a server set up to serve several campaigns or versions at once. That is as much as the names allow. We did not fetch the files, so we cannot say how they belong together.

What VIP Keylogger can take from a Windows PC

We do not know what evacompltd.site's own copy took, because we did not open it. The table below is what Splunk found in VIP Keylogger in general, so it describes the family the reporter named.

What this can cost you

Seeing the address in a log or a block message costs you nothing. The risks below are for a PC where one of its script files was opened.

• High

  Account takeover

  A stealer takes cookies, saved logins and what you type. Changing the password alone may not end a stolen session, so sign out everywhere as well.

• High

  Crypto theft

  Splunk says the clipboard is watched and wallet addresses are replaced. Stolen crypto cannot be reversed, so check every address before you send, and move funds from any wallet that was on the PC.

• High

  Exposed secrets on the screen and in keystrokes

  Screenshots and a keylogger catch things that are never saved: one time codes, bank pages, private messages. Treat anything you typed on the PC as seen.

• Medium

  A loader that starts again

  The UserInitMprLogonScript value reruns the loader at each logon. Until it is found and removed, the PC may keep contacting the attackers.

• Medium

  Work accounts and company data

  Logins saved on a company laptop open company systems. Report it to IT or security quickly so the accounts can be locked.

• Low

  Nothing, if you only saw the address

  An address in a firewall log, a blocked link or a warning is not an infection.

What you may notice, and what you may not

Many victims notice nothing. The signs below follow from how Splunk describes the family; the first ones are the best evidence you have.

How people end up running a script like this

We do not know how visitors reached evacompltd.site, and no source says. Splunk names the route for VIP loaders in general: phishing email.

1. 1

   An email about a payment, an order or a delivery

   Splunk lists bank payment notices, procurement orders and logistics updates as the lures. The attachment or link leads to a script file.

2. 2

   A script that is passed off as a document

   A .js, .vbs or .bat file is a program. Windows runs it when you double click it; it is not shown as a document.

3. 3

   A command you are told to paste

   The ps1 files could be started by a pasted PowerShell line. No source tells us this site did so, and we did not see its page.

4. 4

   A file that claims to be an update or free software

   This is a common way to hand out stealers. It is general knowledge, not something we saw on this domain.

Check your Windows PC before you delete anything

Start with the question that matters: did you open a script file or paste a command that fetched something from evacompltd.site, or run a file that came from it? If yes, follow the numbered plan on this page, because a clean-looking check does not clear a PC. If you are not sure, do these checks first. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from Wi-Fi and network cables if you can.

1. 1

   Look at HKCU\Environment

   Open Registry Editor (press the Windows key, type regedit, press Enter) and go to HKEY_CURRENT_USER\Environment. Look for a value named UserInitMprLogonScript, a value named INTERNAL_DB_CACHE or any very long text value. Splunk says these are the traces of VIP loaders. Write down or photograph what you see; do not delete it yet.

2. 2

   Look for the screenshot folder

   Open File Explorer and go to Documents. A folder named VIPREcovery with a Screenshot.png in it is the sign Splunk describes. Do not open or delete it yet; note it.

3. 3

   Look in the hidden Libraries folder

   Press Windows key + R, type %appdata%\Microsoft\Windows\Libraries and press Enter. In View > Show > Hidden items, look for a file you did not put there. Splunk says a .bat loader drops its payload here.

4. 4

   Look for a scheduled task or a Startup file you did not make

   Press the Windows key, type Task Scheduler and open it. Select Task Scheduler Library and read any task that is new or has a random name. Then press Windows key + R, type shell:startup and press Enter. Note anything unknown.

5. 5

   Check Windows Security

   Open Windows Security > Virus & threat protection > Protection history. On Windows 10 the same page is under Settings > Update & Security > Windows Security. Look for detections dated around the time the script ran.

6. 6

   Remember what a clean check means

   The stages are built to run from memory and the loader deletes itself, so little may be left on the disk. A clean check lowers the doubt; it does not remove it.

Scan from outside Windows: Microsoft Defender Offline

An offline scan runs before the normal Windows starts, so a hidden program cannot hide from it as easily. Microsoft's page says it targets malware that tries to bypass the Windows shell, such as rootkits.

1. 1

   Get the PC ready

   Microsoft's page warns that the PC will restart and that the scan runs for roughly a quarter of an hour, so finish and save what you are doing first. The account you use must be a local administrator. The scan also needs the recovery environment (WinRE) switched on: in an administrator Command Prompt run reagentc /info, and if the answer is Disabled, run reagentc /enable. With WinRE off, Microsoft says, nothing happens and no error appears.

2. 2

   Pause BitLocker

   A PC with BitLocker on the system drive may ask for the recovery key when it boots into the scan. Suspend BitLocker protection beforehand to avoid being locked out.

3. 3

   Launch the offline scan

   Go to Windows Security > Virus & threat protection > Scan options, pick Microsoft Defender Offline scan and press Scan now. Confirm the prompts. Windows signs you out and restarts into a blue scanning screen, then boots normally. An administrator PowerShell window can start the same scan with Start-MpWDOScan.

4. 4

   Find out what it found

   Open Windows Security > Virus & threat protection > Protection history after the restart. The detection name is shown there. Per Microsoft, the offline scan is not available on Windows for ARM, and it receives updates only when Microsoft Defender Antivirus is your main antivirus.

5. 5

   A quiet result is not an all clear

   Here the stealer may have run once, sent its data and left. An empty scan result cannot undo that. If a script from this address ran, plan to back up your documents and reinstall Windows.

If you use a Mac, an iPhone or an Android phone

The ps1 tag and the family point at Windows. We found nothing that says the six files run on anything else.