[Koahku]

Using Volafile to host the keylogger executable seems like a pretty bad choice considering that this website will delete your files after only 2 days. Or maybe this shouldn't surprise me so much considering the "skills" of the attacker.

[wtracy]

They probably expect to upload a new build every few days, anyway. Note the login credentials hard-coded into the executable.

Presumably, people who take more than 48 hours to open their email were deemed an edge case not worth worrying about.