# AutoIT Payload Injector Delivers VIPKeylogger via Phishing/RAR Chain into charmap.exe

> SANS ISC (diary #33192, Xavier Mertens) documents a banking-themed phishing campaign delivering a RAR archive whose VBS→PowerShell→AutoIT3 chain injects XOR/Base64-obfuscated shellcode into the legitimate charmap.exe process via OpenProcess/VirtualAllocEx/WriteProcessMemory/CreateRemoteThread, ultimately running VIPKeylogger with C2 at cphost17.qhoster.net.

- **Published:** 2026-07-28T00:00:00Z
- **Last reviewed:** 2026-07-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1740
- **ID:** TL-2026-1740
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-07-28, SANS Internet Storm Center handler Xavier Mertens published diary entry #33192 describing an active malware-delivery chain observed in the wild. The lure is a fraudulent banking-themed phishing email carrying the attachment 'Bank_account_details.rar' (SHA256 5c4ca58e41c009c664a7134df12b0fdc0815f572e117fe67ca35582f19d9deab). Inside the archive is an obfuscated VBS script (SHA256 f88d9094a90f7000a3fb2cd7c981e03357ce2b39df9de5ee1d0742e619e3860f) that Base64-decodes an embedded payload and shells out to 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' to decompress it via a GzipStream .NET call. This drops three additional Base64/XOR-obfuscated (XOR keys 0x02 and 0x3D) files: a renamed, randomly-named AutoIT3 script interpreter 'vijewyufveonabghulluonouceyasi.exe' (SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1), an AutoIT injection script 'wwman', and a raw shellcode blob 'Ennnn'. The AutoIT3 interpreter executes 'wwman', which XOR-decrypts 'Ennnn' with key 0xEC and injects the resulting shellcode into the legitimate Windows Character Map utility (charmap.exe) using the classic remote-injection API sequence: OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread (CloseHandle to clean up handles afterward). Using a non-network-facing, rarely-monitored GUI accessibility utility as the injection host is a deliberate detection-evasion choice — EDR/SOC baselines rarely expect charmap.exe to make outbound network connections or host writable+executable memory. Persistence is established via a registry Run key (HKCU\...\CurrentVersion\Run, value name 'Windows32') pointing back at the dropped executable with the argument 'wwmaw', ensuring re-execution at each logon. The chain culminates in deployment of VIPKeylogger, which beacons to C2 domain cphost17[.]qhoster[.]net; the hostname's 'cphost17' prefix is consistent with a cPanel-style hosting subdomain naming pattern, suggesting the actor is riding on shared/commercial hosting rather than dedicated bulletproof infrastructure, though this was not independently confirmed. VIPKeylogger itself is a widely-tracked, subscription-based .NET information stealer/keylogger sold in crimeware-as-a-service channels; it is closely related to (shares code/behavior lineage with) Snake Keylogger (aka 404 Keylogger). Independent vendor research (Splunk Threat Research Team, Forcepoint X-Labs, SOCPrime, PCrisk) documents the family's typical capabilities as: keystroke logging, screenshot capture, clipboard monitoring with cryptocurrency-address-swapping ('clipper') behavior, Wi-Fi password extraction from previously-connected networks, browser-stored credential theft, and exfiltration over channels including Telegram bot APIs and dedicated/DuckDNS-style C2 endpoints, frequently preceded by multi-stage VBS/JS/batch loaders using junk-code padding, PNG steganography, and environment-variable staging to evade static and sandbox analysis. Those family-level TTPs are documented for VIPKeylogger broadly and were not all independently re-verified by SANS ISC for this specific charmap.exe-injection variant, but they characterize the payload's expected post-injection behavior once active on a victim host. No CVE is associated with this campaign (it exploits process trust and phishing, not a software vulnerability), and it does not appear in the CISA KEV catalog. Given the banking-themed social-engineering lure combined with a credential/keystroke-stealing payload, financial gain is the most plausible motivation; no specific threat actor or nation-state attribution has been published.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1059.001 PowerShell
- T1059.010 AutoHotKey & AutoIT
- T1547.001 Registry Run Keys / Startup Folder
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1055 Process Injection
- T1497.001 System Checks
- T1620 Reflective Code Loading
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1056.001 Keylogging
- T1113 Screen Capture
- T1115 Clipboard Data
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication

## Sources

- [AutoIT Payload Injector](https://isc.sans.edu/diary/33192)
- [Behind the Code: The Layered Defense-Evasion of VIP Keylogger](https://www.splunk.com/en_us/blog/security/behind-the-code-layered-defense-evasion-vip-keylogger.html)
- [Analytics Story: VIP Keylogger](https://research.splunk.com/stories/vip_keylogger/)
- [VIPKeyLogger Infostealer in the Wild](https://www.forcepoint.com/blog/x-labs/vipkeylogger-infostealer-malware)
- [VIP Keylogger Uses Steganography and Script Obfuscation](https://socprime.com/active-threats/vip-keylogger-and-its-multi-layered-evasion-tactics/)
- [VipKeyLogger Malware - Malware removal instructions](https://www.pcrisk.com/removal-guides/31452-vipkeylogger-malware)
- [Hackers Deploy VIP Keylogger Through Phishing Emails Masquerading as Business Documents](https://cybersecuritynews.com/hackers-deploy-vip-keylogger-through-phishing-emails/amp/)
- [New VIPKeyLogger Via Weaponized Office Documents Steals Login Credentials](https://gbhackers.com/__trashed-2/)
- [MITRE ATT&CK Enterprise Matrix](https://attack.mitre.org/matrices/enterprise/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1740