unclassified-autoit-compiled: b017d189 — AutoItSC shellcode→.NET infostealer, K30ZWMBJJ string obfuscation

Executive Summary

AutoItSC single-file PE32 dropper (MSVC 12.0, Jul 2024) that deploys a dual-resource payload (misrun + Esher) to %TEMP%. A hex-ASCII-encoded x86 shellcode intermediary decrypts misrun via a 30-byte XOR key built on the stack, producing a .NET Framework 4.0 PE32 infostealer with keylogger, screenshot, clipboard, and SMTP/FTP/HTTP exfiltration capabilities. Second confirmed AgentTesla inner payload in this corpus. Static-only; no CAPE machine available.

What It Is

• File: b017d1897d3c5b5c51f02fafcbe48700943ebe0921c1c881d4f7ea37fe1eefdc.bin
• Size: 1.02 MB
• Type: PE32 executable (GUI) Intel 80386, 5 sections^[file.txt]
• Linker: MSVC 12.0 (VS 2013), TimeDateStamp: 0x668BAF53 (Jul 2024)^^[pefile.txt]
• AutoItSC: v3.3.8.1 runtime with compiled SCRIPT resource in .rsrc (274 KB, type 10 RT_RCDATA)^^[pefile.txt]
• Unsigned: no Authenticode signature, empty VS_VERSIONINFO^[pefile.txt]
• Script: extracted via autoit-ripper; reveals K30ZWMBJJ string-obfuscation function (permutation table + XOR key "AA")

How It Works

Stage 1 — AutoItSC Loader

The outer PE is a standard AutoItSC single-file executable. The compiled script resource drops two embedded files to %TEMP%:

• misrun — 268 KB encrypted .NET PE payload
• Esher — 14 KB hex-ASCII-encoded x86 shellcode carrier

The script reads Esher from disk, decodes it from printable hex-ASCII (each byte encoded as two hex digits), and executes it via a callback mechanism.

Stage 2 — Shellcode (Esher)

The decoded shellcode (14 KB, entry at offset 0x23B0) performs:

1. Builds the string "C:\\Windows\\System32\\svchost.exe" on the stack^[r2:fcn.000023b0]
2. Builds the 30-byte XOR key "L0LWKP01SHGB7V5E80RSQOBIW2FAUF" on the stack^[r2:fcn.000023b0]
3. Allocates RWX memory (VirtualAlloc, 0x3000, 0x40)
4. Reads misrun from %TEMP%
5. Decrypts via a simple XOR loop in fcn.000022e0 (loop counter compares against 0x1e = 30)^^[r2:fcn.000022e0]
6. The decrypted payload is a valid .NET PE32 executable

Stage 3 — .NET Infostealer (misrun_decrypted_v2.bin)

• Machine: 0x14c (x86)
• Magic: 0x10b (PE32)
• Subsystem: 2 (GUI)
• EntryPoint: 0x436ee
• ImageBase: 0x400000
• Linker: 80.0
• Sections: .text, .rsrc, .reloc
• Imports: mscoree.dll:_CorExeMain only (standard .NET bootstrap)
• Assembly GUID: 256d2426-b4cc-4996-9a99-c8e915357eef
• Framework: .NET Framework v4.0
• Manifest: requireAdministrator UAC level requested

String analysis reveals infostealer capabilities: KeyLogger, Screen_TimerTo_Collect, get_Password/set_Password, get_encryptedPassword, SmtpClient, FtpWebRequest, HttpWebRequest, CredentialCache, NetworkCredential, MailMessage, get_Clipboard, OpenClipboard.^[misrun_decrypted_v2.bin strings]

No hardcoded C2 IPs, domains, or SMTP credentials were recovered from static strings. Configuration is likely runtime-resolved, encrypted in .NET resources, or pulled from a secondary download. This is consistent with the accd2ccd sibling where SMTP C2 mail.myhydropowered.com was only recoverable via deeper .NET resource inspection.

Decompiled Behavior

Ghidra was not successfully invoked for this analysis; radare2 provided the decompiled shellcode view. The shellcode entry (fcn.000023b0) is a position-independent decoder stub with no imports table — it resolves APIs dynamically or relies on the hosting process's import table. The decryption routine (fcn.000022e0) is a tight while loop:

while (i < 0x1e) {  // 30 bytes
    key[i] = stack_key[i];
    i++;
}
// Then XOR-decrypt misrun byte-by-byte with key cycling

No anti-debug, anti-VM, or timing checks observed in the shellcode. The outer AutoItSC runtime also contains no explicit anti-analysis.

C2 Infrastructure

No hardcoded C2 recovered statically. The inner .NET assembly contains the networking classes (SmtpClient, FtpWebRequest, HttpWebRequest) but no plaintext server addresses. Attribution to the AgentTesla family is based on:

• Identical delivery chain (AutoItSC → shellcode → reflective .NET load)
• Identical capability set (keylogger, screenshot, clipboard, SMTP/FTP/HTTP exfil, browser credential theft)
• Same .NET Framework 4.0 target and mscoree.dll:_CorExeMain bootstrap

See agenttesla entity page for known C2 patterns observed in sibling accd2ccd.

Interesting Tidbits

• The K30ZWMBJJ string-obfuscation function in the AutoIt script is a custom permutation table followed by XOR with the two-byte key "AA". This differs from the Caesar-cipher obfuscation (L300CM2V, O30MJJHT) seen in prior siblings.
• The 30-byte XOR key "L0LWKP01SHGB7V5E80RSQOBIW2FAUF" is built entirely on the stack via immediate pushes — no static key in the shellcode binary. This is a mild anti-static measure.
• The shellcode references RegSvcs.exe in addition to svchost.exe, suggesting the author considered multiple process-hollowing targets.
• The .NET assembly GUID 256d2426-b4cc-4996-9a99-c8e915357eef is unique to this sample (no corpus hits).
• Esher as a payload carrier name appears in no prior sibling; the naming convention is random per-sample.

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.8.1 + SciTE editor on Windows 7/10 x86.

Steps:

1. Install AutoIt v3.3.8.1 from the legacy archive.
2. Write a script that drops two FileInstall resources (misrun, Esher) to %TEMP%.
3. Encode shellcode as printable hex-ASCII (each byte → two hex chars).
4. In the script, FileRead() the hex string, convert back to binary via hex-decoding loop.
5. Use DllCall("kernel32.dll", "ptr", "VirtualAlloc", ...) to allocate RWX memory.
6. Copy decoded shellcode to RWX region and execute via DllCallAddress().
7. The shellcode should read the encrypted .NET PE from %TEMP%\misrun, XOR-decrypt with a 30-byte key, and reflectively load it.

Verification: Run capa on the outer PE — should hit the (internal) autoit file limitation warning. The inner .NET PE, if dumped, should show mscoree.dll:_CorExeMain and strings for SmtpClient, KeyLogger, Screen_TimerTo_Collect.

Deployable Signatures

YARA Rule

rule AutoItSC_AgentTesla_3Stage_Loader : malware {
    meta:
        description = "AutoItSC single-file PE32 that drops misrun/Esher dual payload, shellcode decrypts .NET infostealer"
        author = "PacketPursuit"
        date = "2026-06-28"
        sha256 = "b017d1897d3c5b5c51f02fafcbe48700943ebe0921c1c881d4f7ea37fe1eefdc"
    strings:
        $autoit_sc = "AU3!EA06" ascii
        $s_misrun = "misrun" wide ascii
        $s_esher = "Esher" wide ascii
        $s_k30 = "K30ZWMBJJ" ascii
        $s_key = "L0LWKP01SHGB7V5E80RSQOBIW2FAUF" ascii
        $s_virtalloc = "VirtualAlloc" ascii
        $s_cor = "_CorExeMain" ascii
    condition:
        uint16(0) == 0x5A4D and
        $autoit_sc and
        3 of ($s_*) and
        filesize < 2MB
}

Behavioral Hunt Query (Sigma-like)

title: AutoItSC AgentTesla 3-Stage Payload Drop
description: Detects AutoItSC PE dropping misrun/Esher files to TEMP followed by svchost.exe injection
logsource:
  product: windows
  category: file_event
detection:
  selection_drop:
    TargetFilename|contains:
      - '\\Temp\\misrun'
      - '\\Temp\\Esher'
  selection_proc:
    Image|contains: '\\svchost.exe'
    ParentImage|endswith: '.exe'
    CommandLine|contains: '-k '
  condition: selection_drop or selection_proc
falsepositives:
  - Unknown
level: high

IOC List

Behavioral Fingerprint

This binary is an AutoItSC single-file PE32 (MSVC 12.0–14.x linker, ~1 MB, unsigned) with a compiled SCRIPT resource (200 KB–1 MB) in .rsrc. Upon execution it drops two files to %TEMP%: an encrypted .NET PE named with a random lowercase string, and a hex-ASCII-encoded x86 shellcode carrier with a different random name. The shellcode builds a 30-byte XOR key on the stack, allocates RWX memory, decrypts the .NET payload in-place, and reflectively loads it. The inner .NET assembly imports only mscoree.dll:_CorExeMain, targets .NET Framework 4.0, and contains strings for SmtpClient, FtpWebRequest, HttpWebRequest, KeyLogger, Screen_TimerTo_Collect, and clipboard access.

Detection Signatures

References

• unclassified-autoit-compiled — cluster entity page (25 confirmed siblings)
• agenttesla — inner payload family page
• Sibling analysis: accd2ccd — first confirmed AgentTesla delivered via this AutoItSC chain
• MalwareBazaar: b017d1897d3c5b5c51f02fafcbe48700943ebe0921c1c881d4f7ea37fe1eefdc

Provenance

Analysis performed 2026-06-28 on pp-hermes (<lan>). Tools: file, exiftool, pefile, autoit-ripper, radare2 (decompile), Python/pefile (inner payload parsing), strings. CAPE skipped — no Windows guest available. Static-only inference for all runtime behavior.