unclassified-autoit-compiled: 6718622d — Final_order.exe, AutoItSC → Caesar-3 hex shellcode → 19-byte XOR → AgentTesla

Executive Summary

Purchase-order-themed AutoItSC single-file PE32 (Final_order.exe) compiled Jul 2024. Drops two embedded payloads to %TEMP%: a 14 KB Caesar-3 hex-encoded x86 shellcode intermediary (Lityerses) and a 271 KB XOR-encrypted .NET inner payload (emboweling). The shellcode builds a 19-byte XOR key on the stack, decrypts emboweling to a valid .NET Framework PE32, and transfers execution. Decrypted inner payload is a confirmed AgentTesla infostealer with keylogger, screenshot, clipboard, and SMTP exfil capabilities. Thirty-second confirmed sibling in the unclassified-autoit-compiled cluster.

What It Is

Confirmed thirty-second sibling of the unclassified-autoit-compiled AutoItSC cluster. The build fingerprint (MSVC 14.16, empty VS_VERSIONINFO, full PCRE regex runtime, standard WinInet/WinSock/ADVAPI32/GDI import surface) matches every prior sibling in the cluster. The distinguishing trait for this sample is the delivery chain: Caesar-3 hex-obfuscated shellcode with a 19-byte stack-built XOR key, decrypting an AgentTesla .NET payload.

How It Works

Stage 1 — AutoItSC Dropper

The outer PE32 is a standard AutoItSC v3.3.8.1 single-file compiled binary. The compiled AutoIt script is stored as an encrypted SCRIPT resource (type 10, ID 231) inside .rsrc. ^[strings.txt:761] Decompilation via autoit-ripper yields the plaintext script:

FileInstall ( "emboweling" , @TempDir & "\emboweling" , 1 )
FileInstall ( "Lityerses" , @TempDir & "\Lityerses" , 1 )
Local $B30BXE8 = DllCall ( P30R6ODF ( "oivrip762hpp" , 4 ) , ... )
...
Execute ( "DllCallAddress(P30r6oDf(\"lqw\",3), $B3136aWy + 0x23b0)" )

The script:

1. Installs two embedded files (emboweling, Lityerses) to %TEMP% with overwrite enabled.
2. Opens Lityerses via CreateFileW (obfuscated as oivrip762hpp = kernel32.dll shifted back by 3, Caesar-3 cipher).
3. Reads the entire file into a struct.
4. Calls P30R6ODF($L3132NXEOFSC, 3) — a Caesar-3 decoder — on the file contents.
5. Allocates RWX memory (VirtualAlloc) and copies the decoded bytes.
6. Executes at offset 0x23b0 via DllCallAddress.

The P30R6ODF function is the cluster's recurring Caesar-N string decoder, previously observed with offsets 2, 4, 5, and 6 across siblings. This sample uses offset 3.

Stage 2 — Shellcode Decryptor

Lityerses is a 28,674-byte ASCII text file where every character is Caesar-3 shifted. Decoding each character back by 3 yields a continuous hex string (0x55, 0x8b, 0xec, …). The hex string decodes to 14,336 bytes of x86 shellcode.

The shellcode entry point at offset 0x23b0:

1. Allocates a local stack frame (sub esp, 0x3c8).
2. Builds a 19-byte XOR key on the stack using consecutive mov byte [ebp+disp], imm8 instructions:
   • 0x4b 0x55 0x4f 0x35 0x35 0x4e 0x41 0x51 0x32 0x36 0x32 0x58 0x45 0x4c 0x34 0x58 0x4f 0x43 0x39
   • ASCII: KUO55NAQ262XEL4XOC9
3. Opens %TEMP%\emboweling via CreateFileW.
4. Reads the file into a heap buffer.
5. XOR-decrypts the buffer cyclically with the 19-byte key.
6. The decrypted result is a valid .NET Framework PE32.

Stage 3 — AgentTesla Inner Payload

Decrypted emboweling (277,504 bytes) is a .NET Framework 4.x PE32 assembly with the following characteristics:

• SHA-256: a7e9599acb085cf5891c66b90b0fd7a2c8b59fb17c1c7852a7c33eeb5dc9f439
• Timestamp: 0x669085d9 (Jul 2024, matching outer build)
• Sections: 3 (typical for .NET)
• Indicators: SmtpClient, MailMessage, SetWindowsHookExA, KeyLogger, ClipboardProxy, Clip_Replacer, FFLogins, BCryptDecrypt, CryptProtectData, CopyFromScreen

This is a confirmed AgentTesla infostealer variant. No hardcoded SMTP credentials were recovered statically; they are likely runtime-decrypted from an embedded config block (common AgentTesla builder behavior).

Decompiled Behavior

The AutoIt script's control flow is straightforward but wrapped in heavy AutoIt API noise (dummy FileFindNextFile, WinGetText, MouseClick, Cos, Floor calls in nested loops). The effective logic occupies lines 1–16 of the decompiled script; the remaining ~7,700 lines are dead-code noise generated by an AutoIt obfuscator.

The shellcode at 0x23b0 is position-independent and uses only kernel32.dll imports resolved via hardcoded ordinals or PEB walking (not statically visible in the outer binary's IAT). No TLS callback or anti-debug checks were observed in the outer PE.

C2 Infrastructure

No hardcoded C2 strings were recovered from the outer binary or the decrypted .NET payload. AgentTesla typically resolves SMTP credentials at runtime from an encrypted config blob. Static analysis of the .NET assembly reveals SMTP infrastructure references (SmtpClient, MailAddress, NetworkCredential) but not the actual server or credentials.

Inferred C2 channels (from AgentTesla family knowledge):

• SMTP over TLS/SSL (STARTTLS or SMTPS on port 587/465)
• Possible FTP or Telegram fallback (not observed in this specific payload)

Interesting Tidbits

• Caesar-3 variant: The P30R6ODF string decoder in this sample uses a shift of 3 (previously observed shifts in cluster: 2, 4, 5, 6). The shellcode itself is also Caesar-3 obfuscated as a hex string, a two-layer encoding.
• 19-byte XOR key: Longer than the 12-byte key used in sibling 64b37e90 (K6N462UY5STOB8GAAC0UF0J0UA752I) and the 30-byte key in b017d189 (L0LWKP01SHGB7V5E80RSQOBIW2FAUF). The key KUO55NAQ262XEL4XOC9 contains the cluster's recurring alphanumeric pattern.
• Payload naming: emboweling (287 KB encrypted PE) and Lityerses (28 KB shellcode) follow the cluster's convention of biological/lexical nonce words — turbinate/selectee, misrun/Esher, Hymenophyllaceae/isochronally, etc.
• Jump offset consistency: The DllCallAddress jump target 0x23b0 matches sibling 64b37e90 (shellcode offset 9136 decimal), suggesting a shared shellcode template or generator.
• .NET Framework, not Native AOT: Unlike sibling bee6e88e (first .NET Native AOT AgentTesla in corpus), this inner payload is a conventional .NET Framework 4.x assembly with full CLR metadata, making it analyzable with dnSpy/ILSpy.

How To Mess With It (Homelab Replication)

Reproducing the AutoItSC + Caesar-3 + XOR chain

1. Toolchain: AutoIt v3.3.8.1 + SciTE4AutoIt3 on Windows. Compile with Aut2Exe to a single-file PE32.
2. Shellcode generator: Write a small C/x86 NASM stub that:
   • Builds a fixed XOR key on the stack with mov byte [ebp-N], imm8
   • Calls CreateFileW → ReadFile on a hardcoded %TEMP%\payload.bin
   • Loops xor [esi], al with key cycling
   • Jumps to decrypted PE entry point
3. Encoding layer: Encode the shellcode bytes as a hex string (0x55, 0x8b, ...), then Caesar-shift every character forward by 3. Save as Lityerses.
4. Payload preparation: Encrypt a .NET PE with the same XOR key (19 bytes). Save as emboweling.
5. AutoIt script: Use FileInstall to drop both files, DllCall("kernel32.dll", "CreateFileW", ...) to read Lityerses, Caesar-decode with a P30R6ODF loop (Chr(Asc(c)-3)), VirtualAlloc RWX, DllCallAddress at offset 0x23b0.
6. Verification: Run the compiled PE in a VM. %TEMP% should contain emboweling and Lityerses; the decrypted emboweling should execute as a .NET assembly.

What you'll learn

How to chain a compiled-script dropper with a position-independent shellcode decryptor, and why the Caesar-3 encoding buys nothing against a determined analyst but slows string-matching engines.

Deployable Signatures

YARA — AutoItSC Caesar-3 Shellcode Dropper

rule autoitsc_caesar3_shellcode_dropper
{
    meta:
        description = "AutoItSC single-file PE32 with Caesar-3 obfuscated shellcode and XOR payload"
        author = "triage-pipeline"
        date = "2026-07-03"
        sha256 = "6718622d94d373a123cac9f8cc6789bc1132eed19a5a9232dd0454ee869d910c"
    strings:
        $autoit_marker = "This is a third-party compiled AutoIt script." ascii
        $pcre_table = "regular expression is too large" ascii
        $caesar3_api1 = "oivrip762hpp" ascii          // kernel32.dll +3
        $caesar3_api2 = "lerhpi" ascii               // kernel32.dll CreateFileW fragment
        $caesar3_api3 = "GviexiJmpi" ascii           // kernel32.dll CreateFileW fragment
        $script_resource = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        uint16(0) == 0x5a4d and
        pe.number_of_sections == 5 and
        $autoit_marker and
        $pcre_table and
        (2 of ($caesar3_api*)) and
        pe.sections[3].name == ".rsrc" and
        filesize < 2MB
}

YARA — AgentTesla .NET Inner Payload

rule agenttesla_dotnet_generic
{
    meta:
        description = "AgentTesla .NET Framework infostealer — generic static fingerprint"
        author = "triage-pipeline"
        date = "2026-07-03"
    strings:
        $s1 = "KeyLogger" wide ascii
        $s2 = "ClipboardProxy" wide ascii
        $s3 = "Clip_Replacer" wide ascii
        $s4 = "FFLogins" wide ascii
        $s5 = "SetWindowsHookExA" ascii
        $s6 = "BCryptDecrypt" ascii
        $s7 = "SmtpClient" wide ascii
        $s8 = "MailMessage" wide ascii
        $s9 = "CopyFromScreen" wide ascii
        $s10 = "Screen_TimerTo_Collect" wide ascii
    condition:
        uint16(0) == 0x5a4d and
        6 of them
}

Behavioral Fingerprint

This binary drops two files to %TEMP% with unusual biological-lexical names (emboweling, Lityerses), allocates RWX memory via VirtualAlloc, and executes shellcode at a fixed offset (0x23b0) from a heap buffer. The shellcode reads one dropped file back from disk and XOR-decrypts it with a key built on the stack. The decrypted payload is a .NET assembly that loads SmtpClient, SetWindowsHookExA, and BCryptDecrypt.

IOC List

Detection Signatures

References

• Outer sample: 6718622d94d373a123cac9f8cc6789bc1132eed19a5a9232dd0454ee869d910c
• Inner payload: a7e9599acb085cf5891c66b90b0fd7a2c8b59fb17c1c7852a7c33eeb5dc9f439
• Wiki entity: unclassified-autoit-compiled
• Wiki entity: agenttesla
• OpenCTI artifact: a635e85b-e3b9-40bf-b1fd-08d299c69761

Provenance

• Outer binary triaged 2026-05-26; deep analysis 2026-07-03.
• File type: file v5.45; capa v7.1.1; pefile v2023.2.7; exiftool v12.76.
• AutoIt script recovered with autoit-ripper (installed at /usr/local/bin/autoit-ripper).
• Shellcode decoded manually: Caesar-3 character shift → hex string → binary.
• XOR key extracted from disassembly of shellcode at offset 0x23b0 (ndisasm not available; manual x86 opcode parsing).
• Inner payload decrypted with Python (bytes([emb[i] ^ key[i % 19] for i in range(len(emb))])).
• .NET assembly confirmed via file magic: PE32 executable (GUI) Intel 80386 Mono/.Net assembly.
• No dynamic analysis (CAPE skipped — no Windows guest available). All C2 inferences are static or family-derived.