threat-intel
AutoIT Payload Injector , (Tue, Jul 28th)
High
.png)
Summary
A wave of emails containing RAR archives containing AutoIT scripts are delivering a VIPKeylogger malware. The AutoIT scripts use legitimate tools like `charmap.exe` to inject and execute the malware, leveraging AutoIT's ability to call any API. The malware communicates with a command-and-control server and establishes persistence via registry keys. This campaign utilizes a long-standing malware technique, with AutoIT once again proving its versatility in delivering malicious payloads.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data