Malware Analysis - Unpacking AutoIt stub with large obfuscated script
Channel: MalwareAnalysisForHedgehogs
Date: 2024-01-27

We look at two ways to unpack malware that was crypted with an AutoIt packer. 
At first we trick our way to the payload, skipping the AutoIt script altogether. 
At the second run we thoroughly analyse the packer stub, decrypt strings, unpack the shellcode and find the decryption function in it.

Malware Analysis course: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?couponCode=02F3FAD5E2153D4D789E

sample: https://bazaar.abuse.ch/sample/ee69b74d0f0dd59fcd87304863626efb727ad6255bc29a7d48b7a441390dff1a/
binary refinery: https://github.com/binref/refinery
autoit-ripper: https://github.com/nazywam/AutoIt-Ripper
AgentTesla config extractor: https://github.com/struppigel/hedgehog-tools/tree/main/AgentTesla

Follow me on Twitter: https://twitter.com/struppigel

00:00 Intro
00:25 Triage
03:38 Way 1: Unpacking by guessing
10:10 Way 2: Finding the code in large scripts
12:22 String decryption
29:51 Shellcode decryption
32:19 Shellcode analysis
34:32 Config extraction
37:31 3 lessons we learned

#autoit #malware #unpacking #malwareanalysis #reverseengineering