Autoit

AutoIt is a type of malware that exploits and damages computer systems by infiltrating them through suspicious downloads, emails, or websites. It utilizes a complex attack chain involving an SFX archive that unpacks an AutoIt script and executes "MicrosoftStores.exe". This action subsequently launches the MeshAgent tool. The AutoIt script then triggers a command file, downloading a Python infostealer. An interesting feature of the AutoIt interpreter is its unique method of reading files specified in its launch argument. The infection process continues with two DLL files using the same technique as the initial stage: they employ a legitimate AutoIt interpreter and another A3X implant located in the signature of the legitimate dynamic library. The components of this malware use a variety of programming languages such as C++, .NET, Python, VBS, and AutoIt itself. These scripts are deobfuscated to reveal their contents, as shown in the provided images. In addition to these operations, the AutoIt script opens the legitimate Google "Sign in" page in kiosk mode, setting a parameter to ignore the F11 and ESC keys on the victim's browser. However, it's important to note that the AutoIt script does not directly steal credentials. Instead, it works in combination with other malware, such as StealC, to extract the information. This multi-faceted approach makes AutoIt a potent threat to system security.