Malware

AutoIt backdoor

AutoIt backdoor is a Windows backdoor implemented with AutoIt that supports command-and-control communications, PowerShell-based staging, privilege escalation, and victim file discovery. Reported behavior includes sending Base64-encoded command-and-control responses, downloading PowerShell content that decodes into a shellcode loader, and attempting to elevate privileges by bypassing Windows User Account Control. It also enumerates victim documents and other potentially valuable files by extension, indicating collection-oriented reconnaissance and post-compromise targeting of user data. The malware is associated with in-memory or script-based follow-on execution through PowerShell rather than functioning solely as a standalone payload. Available reporting supports its use as a post-compromise access and execution component on Windows systems, but does not establish a more specific delivery vector or a confidently attributed threat actor from the supplied facts.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.001PowerShellEvidence7

AppleSeed has the ability to execute its payload via PowerShell... APT19 used PowerShell commands to execute payloads... APT28 downloads and executes PowerShell scripts and performs PowerShell commands... Start-Process / Invoke-Command / System.Management.Automation

Privilege Escalation

1 technique

T1548.002Bypass User Account ControlEvidence3

The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence5

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Command and Control

3 techniques

T1105Ingress Tool TransferEvidence1

Multiple entries state PowerShell was used to 'download and execute payloads,' 'download additional scripts,' 'retrieve the malicious payload,' or 'download files from the C2 server.'

T1132Data EncodingEvidence3

ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.

T1132.001Standard EncodingEvidence1

ACTIVITY FEED

Recent activity

18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

18 SOURCESView more in app

mitre attack websiteNews

Apr 25, 2022

Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 - Enterprise | MITRE ATT&CK®

Backdoor that downloads a PowerShell-based shellcode loader.

mitre attack websiteNews

Oct 21, 2021

Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 - Enterprise | MITRE ATT&CK®

Backdoor that downloads a PowerShell script which decodes into a shellcode loader.

mitre attack websiteNews

Oct 21, 2021

Data Encoding: Standard Encoding, Sub-technique T1132.001 - Enterprise | MITRE ATT&CK®

Backdoor that uses Base64-encoded command-and-control responses.

mitre attack websiteNews

Jan 1, 2021

Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 - Enterprise | MITRE ATT&CK®

Backdoor that retrieves a PowerShell-based shellcode loader.

+14 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

AutoIt backdoor