Fake bank email spreads AutoIT keylogger via PowerShell

THE content discusses a recent wave of malware utilizing AutoIT, specifically a technique involving an 'AutoIT Payload Injector'. The attack begins with a fake bank email containing a RAR archive that holds a VBS script. This script decodes a Base64 payload, saves it to disk, and uses PowerShell to decompress it. The payload execution results in the creation of new files that are Base64 encoded and XOR encrypted.

Ultimately, the infection installs a keylogger (VIPKeylogger) that communicates with an external server (cphost17.qhoster.net). The AutoIT scripts leverage legitimate Windows processes (e.g., charmap.exe) for malicious purposes by utilizing various API calls for process injection and memory manipulation.