asgardprotector: 87a158f2 — Signed IExpress SFX dropper with stolen FileZilla cert, AutoIt3 + Easter.a3x

Executive Summary

Third confirmed sibling in the asgardprotector cluster. Same repackaged wextract.exe IExpress SFX base (identical PDB GUID and fabricated 2085 timestamp) as d59dc2f2 and d364a2f6, but with two significant deltas: (1) the outer PE carries a stolen Authenticode signature issued to Tim Kosse (FileZilla project), where previous siblings were unsigned; and (2) the compiled AutoIt payload is named Easter.a3x rather than Terminals.a3x or Dayton.a3x. Inner AutoIt3.exe v3.3.18.0 is legitimate and signed by AutoIt Consulting Ltd. Static-only analysis — CAPE skipped (no Windows guest); .a3x behavior remains opaque without dynamic execution or an AutoIt decompiler.

What It Is

How It Works

The outer binary is wextract.exe, the Microsoft IExpress CAB self-extractor. Execution flow is identical to the sibling cluster:

1. Extracts the embedded CAB to %TEMP%\msdownld.tmp (or similar temp path).^[strings.txt:100]
2. Reads the RUNPROGRAM directive from the SED stored in .rsrc.^[strings.txt:91]
3. Executes "AutoIt3.exe" Easter.a3x.^[strings.txt:3225]
4. POSTRUNPROGRAM triggers rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s" to delete extracted files after execution.^[strings.txt:288]^[strings.txt:92]

The .rsrc section (2.05 MB, entropy 7.64) holds the CAB archive plus standard IExpress UI resources (AVI spinner, manifest). Resource directory timestamps are not visible in this pefile dump but the CAB file times inside the archive are 2026-05-21, indicating recent repacking.

The malicious logic lives entirely inside Easter.a3x, which is a compiled AutoIt binary blob opaque to static string analysis.^[floss.txt] Floss failed due to a CLI argument error (same pipeline bug as siblings); even if it had run, the outer SFX contains no C2 strings. The .a3x would require an AutoIt decompiler (e.g. Exe2Aut) or CAPE detonation to inspect.

Decompiled Behavior

The outer SFX is unmodified wextract.exe code. Ghidra analysis of the sibling d59dc2f2 (same PDB GUID) confirms:

• Entry at 0x140001150 → __security_init_cookie → __mainCRTStartup.^[ghidra:entry-140001150]
• RunInstallCommand (0x14000721c) reads SED directives from .rsrc and spawns the target process.^[ghidra:RunInstallCommand-14000721c]
• GetTempDirectory (0x14000521c) allocates %TEMP%\msdownld.tmp.^[ghidra:GetTempDirectory-14000521c]
• No anti-debug, anti-VM, or encryption in the outer PE — it is a stock system tool with modified resources.

No Ghidra re-run was necessary for this sample because the PDB GUID match guarantees identical code. The delta is entirely in resources and signature.

C2 Infrastructure

None observable from static analysis. The compiled Easter.a3x is the only potential C2-bearing component. Without CAPE detonation or an AutoIt decompiler, network indicators are inaccessible.

Interesting Tidbits

• Stolen certificate delta: The outer SFX is signed with a Sectigo code-signing certificate issued to Tim Kosse, developer of FileZilla. This is the first signed sibling in the cluster. The signature is likely invalid due to post-signing modification (repacked CAB), but the certificate chain is intact in the security directory.^[strings.txt:3280-3310] Compare to d59dc2f2 and d364a2f6 which had empty certificate directories.^[sample d59dc2f2/pefile.txt]
• Script name: Easter.a3x — holiday-themed naming, possibly indicating a campaign or builder batch. Previous siblings used Terminals.a3x (travel lure) and Dayton.a3x (business lure).
• AutoIt3.exe version: v3.3.18.0 (2025-09-07 build), signed by AutoIt Consulting Ltd via GlobalSign Code Signing Root R45. This is a legitimate, current AutoIt interpreter — not a masquerade.^[exiftool.json on extracted AutoIt3.exe]
• Size positioning: 2.19 MB, between the 1.87 MB (d59dc2f2) and 2.22 MB (d364a2f6) siblings. CAB + payload sizes scale with .a3x content.
• Floss pipeline bug: floss.txt contains only CLI help text due to a malformed --no argument; this is a tooling issue, not a sample property.^[floss.txt]
• Capa installer warning: capa flagged the sample as an installer and declined deep analysis.^[capa.txt] This is expected for SFX droppers.

How To Mess With It (Homelab Replication)

Goal: Build a comparable IExpress SFX dropper for red-team / detection-research use.

Toolchain:

• Windows host with iexpress.exe (built into Windows, %SystemRoot%\System32)
• AutoIt3 v3.3.18.0 from https://www.autoitscript.com

Steps:

1. Write a benign AutoIt script (payload.au3) that displays a MessageBox or writes a marker file.
2. Compile it with Aut2Exe.exe to payload.a3x.
3. Launch iexpress.exe, choose "Extract files and run an installation command".
4. Add AutoIt3.exe and payload.a3x to the file list.
5. Set installation command: "AutoIt3.exe" payload.a3x.
6. Choose "No prompt", "Do not show completion message", "No restart".
7. Save as output.exe.

Verification: binwalk output.exe should show Microsoft Cabinet archive data at a non-zero offset, and strings output.exe | grep -i autoit should reveal the embedded filenames.

Detection research value: Use the YARA rule below to hunt for SFX+AutoIt droppers in your environment. The .rsrc entropy >7.4 + AutoIt3.exe string is a strong cluster signal.

Deployable Signatures

YARA rule

rule AsgardProtector_IExpress_SFX_AutoIt3_Dropper {
    meta:
        description = "IExpress/Wextract SFX embedding AutoIt3.exe and .a3x script"
        author = "PacketPursuit SOC"
        date = "2026-06-15"
        reference = "/intel/analyses/87a158f2dfdbc21bae4a72270df0e9e710434d7ae19d8b1ca206d26374a8a966.html"
        hash = "87a158f2dfdbc21bae4a72270df0e9e710434d7ae19d8b1ca206d26374a8a966"
        hash = "d59dc2f22167b0a44bf103d664842112981d4b3dbe62f7a27e671cddbbac9d73"
        hash = "d364a2f6997fd4874ba180207f6785151532c0fd3f014e36d44f330d50037191"
    strings:
        $sfx_magic = { 4D 5A }  // MZ header
        $wextract_pdb = "wextract.pdb" ascii
        $autoit3 = "AutoIt3.exe" ascii wide
        $a3x = ".a3x" ascii wide
        $runprogram = "RUNPROGRAM" ascii wide
        $postrun = "POSTRUNPROGRAM" ascii wide
        $cab_rsrc = ".rsrc" ascii
    condition:
        $sfx_magic at 0 and
        $wextract_pdb and
        $autoit3 and
        $a3x and
        ($runprogram or $postrun) and
        // .rsrc section entropy check via PE section name presence
        pe.sections[4].name == ".rsrc" and
        pe.sections[4].raw_data_size > 0x100000
}

IOC list

Behavioral fingerprint

This binary is a PE32+ x64 Microsoft Cabinet self-extractor with a .rsrc section exceeding 2 MB and entropy >7.6. Upon execution, it writes AutoIt3.exe and a .a3x file to a temporary directory under %TEMP%, then launches the AutoIt interpreter with the compiled script as its argument. The outer SFX may carry a code-signing certificate (observed both signed and unsigned variants in the same cluster). No network indicators are visible in the outer SFX; all malicious behavior is expected to reside in the compiled AutoIt script.

Detection Signatures

References

• 87a158f2dfdbc21bae4a72270df0e9e710434d7ae19d8b1ca206d26374a8a966 (this analysis)
• asgardprotector — family entity page
• iexpress-sfx-dropper — concept page for the delivery mechanism
• autoit-compiled-script-dropper — concept page for the payload pattern
• stolen-certificate-signing — concept page for the certificate abuse pattern
• Sibling: d59dc2f22167b0a44bf103d664842112981d4b3dbe62f7a27e671cddbbac9d73 (SomaliaCruises.exe, Terminals.a3x)^[raw/analyses/d59dc2f2/report.md]
• Sibling: d364a2f6997fd4874ba180207f6785151532c0fd3f014e36d44f330d50037191 (StatingConnectors.exe, Dayton.a3x)^[raw/analyses/d364a2f6/report.md]

Provenance

• File type: file v5.45^[file.txt]
• PE sections & headers: pefile Python module^[pefile.txt]
• Strings: strings from binutils^[strings.txt]
• Floss: flare-floss v2.3.0 (failed due to CLI argument error)^[floss.txt]
• Capa: Mandiant capa v7 (installer limitation warning)^[capa.txt]
• Binwalk: binwalk v2.3.4^[binwalk.txt]
• radare2: rabin2 v5.9.2^[rabin2-info.txt]
• CAB extraction: 7z v23.01
• Certificate dump: openssl pkcs7 + x509 on security directory DER blob
• No dynamic analysis available (CAPE skipped — no Windows guest)^[dynamic-analysis.md]