A malware attack involving multiple layers of AutoIT code has been discovered. The initial file, disguised as a project file, contains AutoIT script that generates and executes a PowerShell script. This script downloads an AutoIT interpreter and another layer of AutoIT code. Persistence is achieved through a startup shortcut. The second layer of AutoIT code is heavily obfuscated and ultimately spawns a process injected with the final malware, likely AsyncRAT or PureHVNC. The attack utilizes various techniques including file downloads, script execution, and process injection to deliver and maintain the malicious payload. Author: AlienVault
Related Tags:
T1059.006
T1204.002
T1547.001
T1059.001
T1574.002
AsyncRAT
T1105
RAT
autoit
Associated Indicators:
xcvbsfq32e42313.xyz
https://xcvbsfq32e42313.xyz/OLpixJTrO
https://xcvbsfq32e42313.xyz/hYlXpuF.txt