AutoIT Scripts Used in New Malware Campaign for Payload Injection
A recent malware campaign leverages AutoIT scripts to inject malicious payloads into legitimate processes, originating from phishing emails that deploy a multi-stage infection chain.
A new malware campaign has been observed utilizing AutoIT scripts for sophisticated payload injection techniques. Threat actors continue to favor AutoIT due to its ease of use and powerful scripting capabilities, which allow for the manipulation of system processes.
The attack chain commences with a phishing email, masquerading as a bank notification, which contains a RAR archive. Upon extraction, this archive yields a VBScript. This initial script is designed to decode a Base64-encoded payload, save it to disk under a randomized filename, and then execute a PowerShell interpreter to decompress the file, which is often in a GZIP format.
Following the decompression, the VBScript invokes another PowerShell process. This second PowerShell script is responsible for dropping three additional files onto the compromised system. These files are then Base64 encoded and subjected to an XOR encryption with specific keys (0x02 and 0x3D) before being written to disk.
One of the dropped executables, identified as "vijewyufveonabghulluonouceyasi.exe," is an AutoIT3 interpreter. This interpreter is then used to execute a second AutoIT script. This AutoIT script is the core of the payload injection mechanism, employing various Windows API calls such as OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread to inject shellcode into a legitimate process, likely charmap.exe, for persistence and to evade detection.
Persistence is established through a standard Windows Run key in the registry, ensuring the malicious payload is executed upon system startup. The AutoIT script decodes the embedded shellcode using an XOR key of 0xEC, then injects it into the target process.
The ultimate payload delivered by this campaign is identified as VIPKeylogger, a malware designed to steal sensitive information. This keylogger communicates with a command-and-control server located at cphost17[.]qhoster[.]net.
This campaign highlights the continued relevance of AutoIT in the malware landscape, demonstrating how it can be integrated into complex attack chains involving VBScript, PowerShell, and custom encryption to achieve stealthy execution and payload delivery. The use of legitimate system utilities like charmap.exe for process injection further complicates detection efforts.
The analysis of this campaign is supported by similar findings in other threat intelligence reports, indicating a coordinated or evolving trend among threat actors employing AutoIT for advanced persistent threats and information-stealing malware.