AutoIT Payload Injector , (Tue, Jul 28th)

An email campaign delivers a RAR attachment containing a VBS that decodes a Base64 payload and uses PowerShell to drop an AutoIT interpreter and associated scripts; those AutoIT scripts XOR-decode embedded files, persist via a Run registry key, launch charmap.exe, and inject XOR-decoded shellcode that installs VIPKeylogger which contacts cphost17.qhoster.net. The report includes SHA256 hashes, code snippets, API/TTP mappings (OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread), and links to related analyses.