{"id":"e0d1751cc03e266e5c44ca729db16d6e","title":"AutoIt_Stealer — AutoIt_Stealer · 木马/恶意软件 · PE32","md5":"e0d1751cc03e266e5c44ca729db16d6e","sha256":"1cd822b584795da0981798fd11958635deaccc72b50ba2a6c3e9981fa4f94c29","family":"AutoIt_Stealer","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"C++","file_format":"PE32","compiler":"Microsoft_Visual_C++_AutoIt3","published_at":"2026-08-08T16:00:00.000Z","summary":"该样本是采用 UPX 3.07 加壳的 AutoIt 3.X 编译恶意程序。解包后暴露完整的 AutoIt 解释器 (2,457 个函数) 和加密的恶意脚本资源 (645KB)。 核心恶意能力： 网络通信：WININET (HTTP/HTTPS/FTP)、WSOCK32 (TCP/UDP 原始套接字)、IPHLPAPI (ICMP/网络探测) 信息窃取：PRINTSCREEN (屏幕截图)、进程枚举 (PSAPI)、用户配置加载 (USERENV) 持久化：注册表操作 (ADVAPI32 RegCreateKeyExW/RegSetValueExW)、启动文件夹 (STARTUPCOMMONDIR/STARTUPDIR) 权限提升：令牌操作 (AdjustTokenPrivileges/DuplicateTokenEx)、SeAssignPrimaryTokenPrivilege 隐匿执行：AUTOIT NO CMDEXECUTE 指令、TaskbarCreated 消息监听 AutoIt 脚本资源 (RCData Type 10, 645,647 字节) 经过加密处理，无法直接提取 C2 地址。脚本通过 AutoIt 解释器在运行时解密执行。","url":"https://zseceye.com/report/e0d1751cc03e266e5c44ca729db16d6e","json_url":"https://zseceye.com/report/e0d1751cc03e266e5c44ca729db16d6e.json","html_url":"https://zseceye.com/report/e0d1751cc03e266e5c44ca729db16d6e","hash_urls":{"md5":"https://zseceye.com/hash/e0d1751cc03e266e5c44ca729db16d6e","sha256":"https://zseceye.com/hash/1cd822b584795da0981798fd11958635deaccc72b50ba2a6c3e9981fa4f94c29"},"search_urls":{"md5":"https://zseceye.com/?q=e0d1751cc03e266e5c44ca729db16d6e","sha256":"https://zseceye.com/?q=1cd822b584795da0981798fd11958635deaccc72b50ba2a6c3e9981fa4f94c29"},"sample_download_url":"https://zseceye.com/report/e0d1751cc03e266e5c44ca729db16d6e/sample","sample_filename":"1cd822b584795da0.zip","iocs":[],"ips":[]}