RAT Dropped By Two Layers of AutoIT Code
A malware attack involving multiple layers of AutoIT code has been discovered. The initial file, disguised as a project file, contains AutoIT script that generates and executes a PowerShell script. This script downloads an AutoIT interpreter and another layer of AutoIT code. Persistence is achieved through a startup shortcut. The second layer of AutoIT code is heavily obfuscated and ultimately spawns a process injected with the final malware, likely AsyncRAT or PureHVNC. The attack utilizes various techniques including file downloads, script execution, and process injection to deliver and maintain the malicious payload.
Pulse ID: 682afb96260a8200f94a1698
Pulse Link: https://otx.alienvault.com/pulse/682afb96260a8200f94a1698
Pulse Author: AlienVault
Created: 2025-05-19 09:36:22
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#AsyncRAT #Autoit #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #PowerShell #RAT #ScriptExecution #VNC #bot #hVNC #AlienVault
