This is a sample that came to my hands by a spam campaign, and cough in a corporate honeypot. Make a comment under this post with your email if you want a sample. Here is an overview of what you’re going to see in this post:
1) First malware file: .exe
- recognition of the executable’s type (WinRAR SFX)
2) Drops: update.exe + 3 files
- recognition of the dropped PE (AutoIT), and obfuscated AutoIT script
- making a custom python script of script de-obfuscation
- Clear AutoIT script analysis, methods and some thoughts about it.
3) LoadPE method (by the AutoIT script) using an encrypted drop
- making a custom script to decrypt the drop (RC2 encrypted usign CryptoAPI)
- analysis of the final malware. What data does it collect, which format, how does it send them and where.
- reveal some console log messages of the app by just changing it’s IMAGE_SUBSYSTEM byte from PE Header
more here..............http://www.133tsec.com/2014/09/20/autoit-malware-a-detailed-analysis/
1) First malware file: .exe
- recognition of the executable’s type (WinRAR SFX)
2) Drops: update.exe + 3 files
- recognition of the dropped PE (AutoIT), and obfuscated AutoIT script
- making a custom python script of script de-obfuscation
- Clear AutoIT script analysis, methods and some thoughts about it.
3) LoadPE method (by the AutoIT script) using an encrypted drop
- making a custom script to decrypt the drop (RC2 encrypted usign CryptoAPI)
- analysis of the final malware. What data does it collect, which format, how does it send them and where.
- reveal some console log messages of the app by just changing it’s IMAGE_SUBSYSTEM byte from PE Header
more here..............http://www.133tsec.com/2014/09/20/autoit-malware-a-detailed-analysis/