unclassified-autoit-compiled: 0854c21e — Hegeleos/turbinate dual payload, XAMPP build path, numeric-date masquerade

Executive Summary

Forty-seventh confirmed sibling of the unclassified-autoit-compiled AutoItSC single-file PE32 cluster. Drops Hegeleos (368 KB encrypted inner payload) and turbinate (28 KB Caesar-3 hex-encoded shellcode) to %TEMP%, then allocates RWX memory and executes the shellcode at offset 0x23B0 via DllCallAddress. The shellcode builds a runtime XOR key on the stack and decrypts Hegeleos in-place before transferring execution. Inner payload family is unattributed statically; no C2 strings recovered. Compiled Jul 2024 via XAMPP-hosted project at D:\xampp\htdocs\QMCY6SFIQG4ORLPXDS\. Static-only (CAPE skipped — no Windows guest).

What It Is

• File: 1012024.exe — generic numeric-date masquerade suggesting 2024-10-01 deployment.^[file.txt]
• Type: PE32 executable (GUI) Intel 80386, 5 sections, 1.47 MB.^[file.txt]
• Toolchain: AutoItSC v3.3.8.1 single-file compiler, MSVC 14.16 (VS 2017) linker, genuine PE timestamp Fri Jul 26 15:21:05 2024 UTC.^[pefile.txt:34] ^[exiftool.json:15]
• Script placement: .rsrc RT_RCDATA type=10, ID=None, size 411,614 bytes, AU3!EA06 header at offset 16.^[autoit-ripper.txt]
• Build provenance: AutoIt-ripper recovered compilation paths D:\xampp\htdocs\QMCY6SFIQG4ORLPXDS\Hegeleos and D:\xampp\htdocs\QMCY6SFIQG4ORLPXDS\turbinate, plus C:\Users\Administrator\AppData\Local\AutoIt v3\Aut2Exe\aut286E.tmp.^[autoit-ripper.txt]
• VS_VERSIONINFO: Empty (no CompanyName / FileDescription / ProductName). LangID 080904B0 (British English).^[pefile.txt:256-272]
• Signing: Unsigned.^[rabin2-info.txt:30]
• PDB: None.^[pefile.txt]

How It Works

The decompiled AutoIt script follows the cluster's dual-file staging pattern:^[script.au3:1-2]

1. FileInstall drops two embedded resources to %TEMP%:

   • Hegeleos — 368,128 bytes, entropy 7.95, high-entropy encrypted inner payload.^[Hegeleos:entropy]
   • turbinate — 28,674 bytes, Caesar-3 shifted hex string of x86 shellcode.^[turbinate:hexdump]

2. Read turbinate from disk into a DllStructCreate("char[" & size & "]") buffer.^[script.au3:3-10]

3. Caesar-3 decode via X30oR($str, 3) — subtracts 3 from each byte's ASCII value, producing a hex string starting with 0x558bec....^[script.au3:11] ^[script.au3:3089-3097]

4. Allocate RWX memory via VirtualAlloc (return type decoded from Caesar-3 string YluwxdoDoorf → VirtualAlloc, size = BinaryLen($Y3132IbKPb), flProtect = 0x3000 | 0x40 decoded from 3{6333 / 3{73).^[script.au3:12]

5. Copy decoded shellcode into the allocated buffer via DllStructCreate("byte[" & len & "]") + DllStructSetData.^[script.au3:14-15]

6. Execute shellcode at offset 0x23B0 via DllCallAddress("int", $base + 0x23B0).^[script.au3:16]

7. Shellcode behavior (inferred from cluster pattern): constructs a variable-length XOR key on the stack via sequential mov [ebp+disp], imm8, opens Hegeleos with CreateFileW, reads it, XOR-decrypts in-place, verifies MZ / PE\0\0 headers, and transfers execution to the decrypted payload.^[autoit-shellcode-xor-decryptor]

The turbinate-decrypted.bin produced by subtracting 3 from each byte is a raw hex string, not binary shellcode; the script parses it back to bytes at runtime.^[turbinate-decrypted.bin:hexdump]

Decompiled Behavior

• Entry point: AutoIt interpreter → compiled bytecode → script execution begins at line 1.
• Notable functions:
  • X30oR($L32333531R8QXNJ, $G323335326AYM) — Caesar-shift decoder; only non-junk function in the 3,097-line script.^[script.au3:3089-3097]
• Control flow: The script is padded with ~3,000 lines of dead code — nested If/ElseIf/Else blocks, For loops with no side effects, WinGetState, InetGetSize, TraySetOnEvent, GUICtrlSetImage, MouseWheel, Ping, and other AutoIt API calls on hardcoded or uninitialized variables. None of these affect the payload staging logic.^[script.au3:17-3097]
• Anti-analysis: No debugger checks, no VM detection, no timing gates. Evasion is purely the compiled-script encryption layer (capa explicitly warns it cannot handle AutoIt scripts).^[capa.txt]

C2 Infrastructure

No C2 strings, IPs, domains, or URLs recovered statically. Network surface is entirely within the encrypted Hegeleos payload. The AutoIt runtime imports WinInet and WinSock, confirming C2 capability, but specifics are runtime-resolved.^[pefile.txt:274-900]

Staging paths:

Interesting Tidbits

• XAMPP build environment — The recovered paths D:\xampp\htdocs\QMCY6SFIQG4ORLPXDS\Hegeleos and D:\xampp\htdocs\QMCY6SFIQG4ORLPXDS\turbinate indicate the author compiled this on a local Apache/MySQL/PHP stack, possibly for rapid iterative testing.^[autoit-ripper.txt]
• Payload naming convention — Hegeleos (368 KB) and turbinate (28 KB) follow the cluster's biological/lexical nonce pattern: ambiparous/Esher, emboweling/Lityerses, misrun/Esher, Hymenophyllaceae/isochronally. Hegeleos appears to be unique to this sample; no prior sibling uses it.^[script.au3:1-2]
• Numeric-date filename — 1012024.exe is a departure from the cluster's typical document-themed lures (invoice, PO, RFQ, DHL). The generic DDMMYYYY format may indicate mass-distribution or reseller repackaging.
• Empty VS_VERSIONINFO — Consistent with most of the cluster; only 2d720f57 ("Charley") and 3f3540e1 (FileVersion 1.0.9.4) have non-empty version blocks.
• Dead-code volume — At 3,097 lines, this script is mid-range for the cluster (largest is 5833e797 at ~1.11 MB script, smallest is ef71e0f6 at ~186 KB). The padding ratio is roughly 95 % junk.

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.8.1 + SciTE4AutoIt3 on Windows 10/11.

1. Write a minimal AutoIt script that:

   • Drops a payload file and a hex-encoded shellcode file via FileInstall.
   • Reads the hex file, Caesar-3 decodes it, converts hex string to binary.
   • Allocates RWX memory with DllCall("kernel32.dll", "ptr", "VirtualAlloc", ...).
   • Copies binary to buffer with DllStructCreate / DllStructSetData.
   • Executes at offset 0x23B0 with DllCallAddress("int", $base + 0x23B0).

2. Compile with Aut2Exe (x86, single-file). The resulting PE should match the cluster fingerprint: MSVC 14.x linker, AU3!EA06 in .rsrc, full WinInet/WinSock/ADVAPI32/GDI import surface, empty VS_VERSIONINFO.

3. Verification: Run capa <reproducer.exe> — should trigger the autoit file limitation warning and show no meaningful capabilities.^[capa.txt]

Deployable Signatures

YARA Rule

rule AutoItSC_Hegeleos_Turbinate_DualPayload {
    meta:
        description = "AutoItSC single-file PE32 with Hegeleos/turbinate dual payload"
        author = "PacketPursuit"
        date = "2026-07-15"
        sha256 = "0854c21ed7648b1d45e780c75bf6dc9e72858c93caf2828ff5af718c21f63f13"
    strings:
        $au3_hdr = "AU3!EA06" ascii wide
        $hegeleos = "Hegeleos" ascii wide
        $turbinate = "turbinate" ascii wide
        $caesar3_func = "X30oR" ascii wide
        $dllcall_addr = "DllCallAddress" ascii wide
        $offset_23b0 = "0x23b0" ascii wide
        $virtalloc = "VirtualAlloc" ascii wide nocase
        $marker = { A3 48 4B BE 98 6C 4A A9 99 4C 53 0A 86 D6 48 7D }
    condition:
        uint16(0) == 0x5A4D and
        $au3_hdr and
        ($hegeleos or $turbinate) and
        $caesar3_func and
        $dllcall_addr and
        $offset_23b0 and
        $marker
}

Sigma Rule

title: AutoItSC Hegeleos Turbinate Staging
description: Detects AutoItSC single-file PE32 dropping Hegeleos/turbinate to TEMP and executing shellcode via DllCallAddress
logsource:
  product: windows
  category: process_creation
detection:
  selection_autoit:
    - Image|endswith: '\\1012024.exe'
    - CommandLine|contains:
      - 'AU3!EA06'
  selection_files:
    - TargetFilename|contains:
      - '\\Hegeleos'
      - '\\turbinate'
  selection_api:
    - CommandLine|contains:
      - 'DllCallAddress'
      - '0x23b0'
  condition: selection_autoit or (selection_files and selection_api)
falsepositives:
  - Unknown
level: high

IOC List

Behavioral Fingerprint

This binary is a single-file AutoIt v3 compiled PE32 (AutoItSC). On execution, the interpreter decrypts and runs an AU3!EA06-header compiled script stored in the .rsrc section. The script immediately drops two files to %TEMP%: a large encrypted payload named with a biological/lexical nonce word (Hegeleos, ~368 KB) and a smaller hex-encoded shellcode stub (turbinate, ~28 KB). The script Caesar-3 decodes the hex string, parses it to binary, allocates RWX memory via VirtualAlloc, copies the shellcode, and executes it at offset 0x23B0 using DllCallAddress("int", base + 0x23B0). The shellcode then builds a variable-length XOR key on the stack, opens the encrypted payload file, decrypts it in-place, verifies PE headers, and transfers execution. No C2 strings are present in the outer PE; all network logic lives inside the encrypted inner payload.

Detection Signatures

References

• unclassified-autoit-compiled — Cluster entity page with 46 prior siblings
• caesar-3-hex-shellcode-staging — Technique page for the Caesar-3 decoder pattern
• autoit-shellcode-xor-decryptor — Technique page for the XOR key-on-stack shellcode pattern
• MalwareBazaar artifact: e81d54c1-4d45-4892-9327-8b8f3d88f970

Provenance

• file.txt — file v5.44, PE32 executable (GUI) Intel 80386, 5 sections
• exiftool.json — ExifTool 12.76, PE metadata extraction
• pefile.txt — pefile 2024.8.26, full PE header + import table dump
• strings.txt — strings v2.42, 2,725 lines
• capa.txt — Mandiant capa v8.0.1, AutoIt file limitation warning
• rabin2-info.txt — radare2 v5.9.4, rabin2 -I binary summary
• autoit-extracted/script.au3 — autoit-ripper v1.0.0, decompiled AutoIt script (3,097 lines)
• autoit-extracted/Hegeleos — autoit-ripper, extracted encrypted inner payload (368,128 bytes)
• autoit-extracted/turbinate — autoit-ripper, extracted Caesar-3 hex shellcode source (28,674 bytes)
• autoit-extracted/turbinate-decrypted.bin — manual Caesar-3 subtraction producing hex string