Loading malware…
AutoIt is a Windows scripting and automation framework that is frequently abused by threat actors to package or implement malware, rather than a single malware family in its own right. In observed malicious use, attackers deliver a legitimate AutoIt interpreter together with a malicious AutoIt script, or compile the script into an AutoIt executable, to blend in with legitimate administration activity and simplify access to Windows APIs. AutoIt-based payloads have been used in espionage and intrusion campaigns delivered through spearphishing, including LNK-based lures and malicious Office documents exploiting vulnerabilities such as CVE-2012-0158 and CVE-2014-6352.
Malicious AutoIt components documented in these campaigns provide backdoor-style functionality including command execution, directory enumeration, file upload, and file download. AutoIt-based malware has also been used to download additional stages, beacon to command-and-control infrastructure, collect basic host information, and steal data such as documents and browser credentials. Persistence has been established through mechanisms including Windows Task Scheduler. Threat activity associated with AutoIt abuse includes campaigns attributed to Patchwork, also known as Dropping Elephant or Chinastrats, as well as more recent spearphishing operations targeting South Korea. Because AutoIt is a legitimate tool broadly repurposed across unrelated operations, references to AutoIt in intrusion reporting usually indicate the implementation language or runtime of the malicious payload rather than a distinct, consistently defined malware family.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
“Once the payload is executed, an UPX packed AutoIT executable is dropped... the file is an automatically generated AutoIT executable with an AutoIT3 script embedded inside.”
“Once the payload is executed, an UPX packed AutoIT executable is dropped... the file is an automatically generated AutoIT executable with an AutoIT3 script embedded inside.”
“Once the payload is executed, an UPX packed AutoIT executable is dropped... the file is an automatically generated AutoIT executable with an AutoIT3 script embedded inside.”
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Once the payload is executed, an UPX packed AutoIT executable is dropped... the file is an automatically generated AutoIT executable with an AutoIT3 script embedded inside.”
15 distinct techniques documented for this family, organized by ATT&CK tactic.
this DLL serves to drop the script, the actual AutoIt executable, and a “test.txt“ file into the “c:\temp” directory, before executing the script with AutoIt.
Command from Windows shortcut in Windows Startup folder on the infected Windows host: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden -Command C:\W45784602214\Asus.CertificateValidation.2022.1728.641.AutoIt3.exe C:\W45784602214\Asus.CertificateValidation.2022.1728.641.AutoIt3.log
On August 2023, the security researcher 0xToxin documented an infection chain leveraging AutoIT scripts to deliver the DarkGate malware
We noticed 3 different types of code language used for the shellcode loader. NSIS script, AutoIT script and C all implement similar functionality.
The AutoIt script first creates a DllStructure to host the shellcode. It then calls VirtualProtect() to change the memory protection to PAGE_EXECUTE_READWRITE . Finally, the script executes the shellcode using CallWindowProc() .
Скрипт может быть прочитан и проанализирован человеком, однако он слегка обфусцирован: изменению подверглись имена функций и переменных.
The dropped .ttf file is not a font. Per Fortinet, “the dropped .ttf file is actually a disguised Lua script.”
An obfuscated AutoIt script disguised as Health.exe decrypts and decompresses the Lumma Stealer payload.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malicious AutoIt script-based backdoor downloaded via LNK spear-phishing. It establishes persistence through Task Scheduler and supports command execution, directory listing, file upload, and file download.
AutoIt-based malicious script/tooling delivered via LNK spearphishing; establishes persistence via Task Scheduler and provides remote command execution plus file discovery and transfer capabilities.
LNK 기반 스피어피싱 체인에서 정상 AutoIt 실행 파일과 함께 악성 AutoIt 스크립트를 내려받아 작업 스케줄러로 지속성을 확보하고, 원격 명령 실행 및 파일/디렉터리 조작(업로드/다운로드 포함) 기능을 수행하는 형태로 사용됨.
A legitimate Windows automation language/tool abused by the malware to call Windows APIs and support malicious execution.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.