Deep Analysis — 0efed3b303e58e99f42f522e0c357c0b42d5999db3770f8bf43513869215c472

1. Build / RE

Toolchain. AutoItSC v3.3.8.1 single-file PE32 compiler, MSVC 14.16 (VS 2017) linker. Genuine PE timestamp 2024-06-04 19:03:14 UTC.^[exiftool.json] .NET metadata version v4.0.30319 in inner payload.^[rabin2-info.txt]

Packing / Obfuscation. Plain PE32 (non-UPX). Outer AutoIt script uses E30vaJ($string, 3) — a Caesar-3 decoder (ASCII shift −3) — for API names (kernel32.dll → nhuqho65, VirtualAlloc → YluwxdoDoorf) and embedded payload filenames.^[script.au3] The embedded file nonsubmerged is Caesar-3-encoded ASCII hex text that decodes to 14,336 bytes of x86 shellcode.^[floss.txt:67]

Anti-analysis. No VM/debug checks in outer binary. No anti-disassembly in shellcode. The AutoIt interpreter itself provides natural obfuscation (compiled bytecode).^[capa.txt]

Embedded resources. Two files extracted by autoit-ripper:^[floss.txt]

• acrorrheuma — 240,128-byte encrypted payload (entropy 6.73).^[file.txt]
• nonsubmerged — 28,674-byte obfuscated hex text → 14,336-byte x86 shellcode.

Shellcode decryption chain. The shellcode entry at offset 0x23b0 constructs a 17-byte XOR key on the stack via sequential mov [ebp+disp], imm8 instructions:^[r2:fcn.000023b0]

ZQADJ4130PGRELWJM

It then calls fcn.000022e0, a byte-granular XOR loop:^[r2:fcn.000022e0]

for i in range(data_len):
    key_byte = key[i % key_len]
    data[i] ^= key_byte

This decrypts acrorrheuma in-place to a valid PE32 .NET assembly.

Inner payload. Decrypted SHA-256: d4d338b891aa46e718d8ad903ee6424b765ed3aa5666589456942bc3a302ea3b. PE32 GUI Intel 80386 Mono/.Net assembly, 3 sections, linker 11.0, FileVersion 1.0.0.0.^[file /tmp/autoit_extracted/acrorrheuma_decrypted.bin]

2. Deploy / ATT&CK

T1059.005 — Command and Scripting Interpreter: Visual Basic / AutoIt. Outer binary is compiled AutoItSC script.^[dynamic-analysis.md]

T1055 — Process Injection. AutoIt script allocates RWX memory (VirtualAlloc, flAllocationType=0x4000, flProtect=0x40), copies decoded shellcode, and executes at offset 0x23b0 via DllCallAddress.^[script.au3]

T1027 — Obfuscated Files or Information. Caesar-3 string obfuscation (E30vaJ) and 17-byte XOR payload encryption.^[script.au3] [r2:fcn.000022e0]

T1003 — OS Credential Dumping. Inner .NET assembly harvests credentials from 25+ browsers (Chrome, Firefox, Edge, Brave, Opera, Vivaldi, Yandex, Safari, UC Browser, QQ Browser, Torch, Epic Privacy, CentBrowser, Falkon, Flock, MapleStudio, Elements Browser, Liebao, Iridium, CocCoc, 360 Browser), email clients (Outlook, Thunderbird, Opera Mail, Foxmail, IncrediMail, ClawsMail, Postbox, PocoMail, eM Client), FTP clients (FileZilla, CoreFTP, SmartFTP, WinSCP, FTPGetter, FTP Commander, FTP Navigator, WS_FTP), VPN/VNC (NordVPN, OpenVPN, TightVNC, TigerVNC, UltraVNC, RealVNC, DynDNS), Windows Credential Manager, Discord tokens, and MySQL Workbench.^[strings -el acrorrheuma_decrypted.bin]

T1005 — Data from Local System. Collects system info: Time, User Name, OSFullName, IP Address, CPU, RAM, Computer Name.^[strings -el acrorrheuma_decrypted.bin]

T1113 — Screen Capture. HTML-formatted exfiltration reports with <b>, <br>, <hr> tags and screenshot evidence.^[strings -el acrorrheuma_decrypted.bin]

T1115 — Clipboard Data. Clipboard monitoring capability (implied by AgentTesla family traits, though no explicit GetClipboardData string recovered in this variant).^[agenttesla.md]

T1056.001 — Input Capture: Keylogging. AgentTesla standard capability.^[agenttesla.md]

T1041 / T1071.003 — Exfiltration Over C2 Channel / Mail Protocols. Hardcoded SMTP credentials:^[strings -el acrorrheuma_decrypted.bin]

• Server: mail.rrcindia.co.in
• Username: goyal@rrcindia.co.in
• Password: Goyal@0783
• Secondary email: zamanic62@gmail.com

T1082 — System Information Discovery. IP geolocation check via https://api.ipify.org.^[strings -el acrorrheuma_decrypted.bin]

T1497.001 — Virtualization/Sandbox Evasion: System Checks. IP geolocation to detect hosting/VPS environments (standard AgentTesla anti-analysis).^[agenttesla.md]

3. Attribution

Inner payload: AgentTesla. The .NET assembly matches the AgentTesla family signature: extensive browser/email/FTP/VPN credential theft, system info harvesting, HTML-formatted SMTP exfil, api.ipify.org geolocation check, and hardcoded SMTP C2 credentials. This is the sixth confirmed AgentTesla sample in the corpus.^[agenttesla.md]

Outer delivery: unclassified-autoit-compiled cluster. This is the forty-eighth confirmed sibling in the AutoItSC single-file PE32 cluster. It shares the exact delivery pattern with siblings 6718622d, b017d189, 498f7bf3, and 0854c21e: Caesar-3 hex-encoded shellcode → VirtualAlloc RWX → DllCallAddress at 0x23b0 → stack-built XOR key → decrypt embedded payload → execute .NET inner payload.^[unclassified-autoit-compiled.md]

Campaign notes. The SMTP domain rrcindia.co.in (Railway Recruitment Cell India or a lookalike) and the Gmail address zamanic62@gmail.com suggest South Asian targeting. The filename czxyLW.exe is an opaque nonce, consistent with AutoItSC cluster naming.

4. IOCs

Report generated 2026-07-17. Static-only analysis (CAPE skipped — no Windows guest).