> Technique · AutoIt Shellcode XOR Decryptor_

~/packetpursuit $ cat /intel/techniques/autoit-shellcode-xor-decryptor.md

typetechniqueconfidencehighcreated2026-07-05updated2026-07-05shellcodedecryptionxorautoitprocess-injectiont1055

AutoIt Shellcode XOR Decryptor

A shellcode pattern observed across the unclassified-autoit-compiled cluster where an x86 shellcode stub, executed via VirtualAlloc + DllCallAddress, builds a variable-length XOR key on the stack via sequential mov [ebp+disp], imm8 instructions, then reads an encrypted file from disk and decrypts it in-place.

Pattern Definition

  1. AutoIt script drops two files to %TEMP%: an encrypted inner payload and a hex-encoded shellcode stub.
  2. Script allocates RWX memory via VirtualAlloc and copies the decoded shellcode.
  3. Script transfers execution via DllCallAddress at a fixed offset (typically 0x23B0 or 0x23D0).
  4. Shellcode builds XOR key on stack — character-by-character via mov byte [ebp+offset], imm8, producing a 19–30 byte ASCII key.
  5. Shellcode opens encrypted file with CreateFileW, reads it, XOR-decrypts in-place or into a new buffer.
  6. Shellcode transfers execution to the decrypted payload, often via process hollowing or reflective injection.

Observed Key Lengths

Sibling Key Length Key Example
6718622d 19 bytes KUO55NAQ262XEL4XOC9
763ae850 22 bytes K8A7IL856ASBIOOECH3P23
64b37e90 30 bytes K6N462UY5STOB8GAAC0UF0J0UA752I
b017d189 30 bytes L0LWKP01SHGB7V5E80RSQOBIW2FAUF

^[r2:fcn.000023b0] ^[/intel/analyses/6718622d94d373a123cac9f8cc6789bc1132eed19a5a9232dd0454ee869d910c.html] ^[/intel/analyses/64b37e90dd772573c46014c2fa8a1a7a1b69df4a6a16f573d0312360e404c60d.html] ^[/intel/analyses/b017d1897d3c5b5c51f02fafcbe48700943ebe0921c1c881d4f7ea37fe1eefdc.html]

Shellcode Structure

Typical shellcode is 14–28 KB before hex-encoding. Key construction is at the start of the main function (offset ~0x23B0 from allocation base). After key setup, the shellcode:

  • Calls CreateFileW (target payload filename built on stack or passed as argument)
  • Calls ReadFile into a buffer
  • Iterates buffer with xor [buf+i], key[i % len]
  • Verifies DOS header (MZ) or PE header (PE\0\0) at decrypted offset
  • Jumps to reflective loader or directly to payload entry point

Detection / Fingerprint

  • AutoIt DllCallAddress with + 9136 or + 0x23B0 offset
  • Sequential mov byte [ebp+0x??], 0x?? instructions in shellcode disassembly (ASCII key construction)
  • CreateFileW → ReadFile → XOR loop → PE\0\0 header check
  • Payload filenames are obscure biological/lexical terms: ambiparous, emboweling, Lityerses, Nasalis, Hymenophyllaceae, isochronally

Related