{
  "family": "autit",
  "sample_count": 11,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Autit (or simply **AutoIt** malware) refers to a broad heuristic detection for malicious payloads that have been compiled and obfuscated using the legitimate AutoIt scripting language. Threat actors heavily favor AutoIt as a wrapper or 'crypter' because it easily compiles scripts into standalone Windows executables (.exe) that frequently bypass static antivirus detection and AMSI (Anti-Malware Scan Interface).<br><br><b>Understanding AutoIt Malware</b><br>To an end-user, an AutoIt-compiled malware file looks like a normal program (often disguised with a fake icon, like a PDF or Word document). For a security analyst, the presence of a compiled AutoIt script in a temporary directory is a major red flag. AutoIt is rarely used for legitimate purposes in modern enterprise environments. Threat actors use it to write custom droppers, keyloggers, and crypters that hide the true, underlying payload (like a Remcos RAT or Agent Tesla stealer) inside the compiled binary.<br><br><b>Execution and Obfuscation Mechanics</b><br>The infection typically begins with spearphishing (`T1566.001`). The victim executes the `.exe` file (`T1204.002`). The AutoIt runtime (embedded within the executable) starts up and begins executing the heavily obfuscated AutoIt script. This script usually performs anti-sandbox checks (`T1497.001`). If safe, the AutoIt script decrypts the true malicious payload (a PE file or DLL) hidden inside its own resources or appended to the end of the file. It then utilizes techniques like Process Hollowing or RunPE (`T1055.012`) to inject that unencrypted payload directly into a legitimate system process (like `RegAsm.exe` or `vbc.exe`). The AutoIt script then terminates, leaving the invisible payload running.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the secondary payload (often a RAT or stealer). Incident responders should closely monitor EDR logs for 'Anomalous Child Process Spawning'. A major IoC is an unknown executable launching a standard Windows utility (like `RegAsm.exe`) and injecting code into it. Static analysis of the dropper will reveal it is a compiled AutoIt script (identifiable by specific PE section names and embedded AutoIt signatures). Analysts must unpack the AutoIt script to find the true payload.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055.012",
    "T1204.002",
    "T1059",
    "T1027.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing (AutoIt Crypters)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing (RunPE)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter (AutoIt Scripting)",
      "tactic": "Execution"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to prevent the injected payload (often a RAT) from exfiltrating data or moving laterally.",
    "Examine EDR telemetry to identify exactly what legitimate processes the AutoIt dropper injected into, and terminate those processes.",
    "Capture a memory dump (RAM) of the injected process; this is often the easiest way to extract the unencrypted final payload without having to manually decompile the AutoIt script.",
    "Submit the initial AutoIt executable to a dynamic sandbox to identify its C2 infrastructure."
  ],
  "what_to_avoid": [
    "Do not assume the executable is safe just because static AV didn't flag it; AutoIt crypters are specifically designed to generate FUD (Fully Undetectable) binaries.",
    "Avoid relying solely on file deletion, as the injected payload is already running in memory and may have established its own persistence."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}