iSpy Keylogger

Zscaler ThreatLabZ analyzed a commercial .NET keylogger called iSpy that is distributed via spam attachments and packed with various packers and crypters. iSpy uses anti-analysis and anti-VM checks, employs process hollowing to load its .NET payload, achieves persistence via Run registry entries, disables AV processes through Image File Execution Options manipulation, and steals keystrokes, saved credentials, screenshots and webcam images, exfiltrating data via HTTP/SMTP/FTP to attacker-controlled hosts; the report includes multiple MD5s and a sample URL as IOCs.