> Family · AsgardProtector_

~/packetpursuit $ cat /intel/families/asgardprotector.md

typeentityconfidencemediumcreated2026-05-27updated2026-06-15malware-familyloaderevasionpesigning

AsgardProtector

Malware family observed as an iexpress-sfx-dropper that repackages the Microsoft Cabinet self-extractor (wextract.exe) to silently drop and execute an autoit-compiled-script-dropper payload. The outer SFX carries a fabricated PE timestamp, and at least one sibling (87a158f2) carries a stolen Authenticode certificate. The inner CAB contains AutoIt3.exe and a compiled .a3x script.

Overview

Attribute Value
First seen 2026-05-26 (lab corpus)
Platform Windows (PE32+ x64)
Outer binary wextract.exe / IExpress SFX
Payload format Compiled AutoIt3 script (.a3x)
Attributed via OpenCTI label (asgardprotector)
Distribution dropped-by-gcleaner, mix4.file

Build Stack

  • Toolchain: MSVC 14.30 (VS 2022) for the base wextract.exe.^[sample d59dc2f2/exiftool.json]
  • Packing: Microsoft Cabinet (CAB) embedded in .rsrc. No custom packer or encryption on the outer PE.
  • Signing: Mixed — two siblings (d59dc2f2, d364a2f6) are unsigned (certificate directory stripped). Third sibling (87a158f2) carries a stolen Sectigo code-signing certificate issued to Tim Kosse (FileZilla project), likely invalid due to post-signing modification.^[sample 87a158f2/strings.txt]
  • Timestamp manipulation: PE header claims 2085 compilation; resource directory shows 2023-2026 dates, indicating post-build repacking.

Deploy / TTPs

ATT&CK Technique Implementation
T1204.002 Double-click execution of SFX lure
T1059.005 AutoIt3 interpreter runs compiled .a3x script
T1027 Compiled AutoIt script is opaque to static string analysis
T1071 Unknown — requires dynamic analysis of .a3x
T1553.002 Stolen code-signing certificate (observed in 87a158f2 sibling)

Capabilities

  • sfx-silent-extraction
  • cabinet-embedded-payload
  • autoit3-interpreter-execution
  • compiled-script-obfuscation
  • timestamp-manipulation
  • stolen-certificate-masquerade
  • postrun-cleanup-rundll32

Variants / Aliases

  • neuralpulsecore4-sbs (OpenCTI label co-occurring with asgardprotector)

Notable Analyses

  • d59dc2f2 (SomaliaCruises.exe, Terminals.a3x) — unsigned, deep analysis with CAB extraction, Ghidra decompile, YARA/Sigma rules.^[/intel/analyses/d59dc2f22167b0a44bf103d664842112981d4b3dbe62f7a27e671cddbbac9d73.html]
  • d364a2f6 (StatingConnectors.exe, Dayton.a3x) — unsigned sibling, identical PDB GUID.^[sample d364a2f6/strings.txt]
  • 87a158f2 (file, Easter.a3x) — signed variant with stolen FileZilla certificate.^[/intel/analyses/87a158f2dfdbc21bae4a72270df0e9e710434d7ae19d8b1ca206d26374a8a966.html]

Related