Analyzing AutoIt Malware: Tools and Techniques

Chris Neal, a threat researcher at Talos, introduces AutoIt, a Windows scripting language that malware authors favor because it is easy to write, can call functions in Windows DLLs and reaches COM objects. He explains that compiled AutoIt executables store a tokenized, compressed and encrypted script, and that decompilers can recover it. He compares the two common decompilers, prefers the one that handles obfuscation and altered start addresses, and notes that older tooling struggles with 64-bit binaries.

The middle of the talk works through a RAT family sample active since 2017. The presenter confirms it is a compiled AutoIt binary from its version metadata, decompiles it, and then deals with the two main obfuscation styles: execution-flow obfuscation and string obfuscation. For the string case he renames variables in the decoding routine, reimplements it in Python, and applies it to every call site using a regex. He also describes a faster but riskier method of instrumenting the script in the AutoIt editor, and advises disconnecting the analysis VM from the network before running anything.

The closing section covers what to look for once the script is readable: built-in macros used for system enumeration, functions that touch DLLs, the registry or the network, and COM calls through the object-get function. Embedded binaries stored as strings, including a helper DLL and a SQLite library used for a WMI query that lists installed antivirus products, can reveal further behavior. The Q&A touched on sample volume, 32- versus 64-bit handling and how AutoIt compares with PowerShell.