Lokibot Visual Basic Compiler Process Dns Query

Tim Peck@timpeck

•updated Nov 17, 2025•1•0•81

Detects the Visual Basic Compiler (vbc.exe) initiating DNS queries. This is highly anomalous behavior, as vbc.exe is a compiler and should not be making network connections. This technique is used by malware like Lokibot for defense evasion after process injection.