The decrypt function reconstructed C code can be seen here. The encrypted executable is concatenated to the end of the executable. After decryption, another process of the malware executable is created in a suspended state: The script replaces the segments with the decrypted executable, patches the main thread context, and resumes the thread. The x86 code is stored as a byte array in the AutoIt script. 7 samples were packed using an obfuscated script that uses x86 code to decode its payload using a buffer and a password which are transferred as parameters.I found a number of common AutoIt scripts used to pack or drop different malwares and a couple of full-blown malware written entirely in AutoIt. One nice thing about myAut2Exe is that you can run it with command-line arguments from a script. (When using AutoIt3Wrapper, UPX compression is on by default.)Īfter unpacking the UPX (when needed) and filtering the AutoIt executables, I used myAut2Exe, an open-source AutoIt decompiler.

1 too well packed for me to easily see if it is AutoIt relatedĪround 20 of the samples were packed with UPX.Four are RAR executables, two are packed with UPX (Ultimate Packer for eXecutables) I took the latest 50 samples marked as AutoIt that were submitted to the free scanning site VirusTotal. During the last couple of weeks I’ve come across three malware samples packed using compiled AutoIt scripts, so I decided to explore the connection between AutoIt and the malware world.

Autoit script download