IRTriage

Incident Response Triage: Scripted collection of system information valuable to a Forensic Analyst. IRTriage will automatically "Run As ADMINISTRATOR" in all Windows versions except WinXP. The original source was Triage-ir v0.851 an Autoit script written by Michael Ahrendt. Unfortunately Michael'...

AutoIt-Obfuscator

AutoIt Obfuscator — Obfuscation for AutoIt Script Source Code AutoIt Obfuscator is a tool to modify AutoIt script source code in this way to make an analysis of obfuscated code very difficult. More technical details, downloads, documentation available at:...

AutoIt-Ripper

AutoIt-Ripper What is this This is a short python script that allows for extraction of "compiled" AutoIt scripts from PE executables. References This script is heavily based on 3 resources, definitely check them out if you want to dig a bit deeper into AutoIt stuff:...

karton-autoit-ripper (>=1.0.0, <=1.0.1), malduck (>=1.0.0, <=3.1.1) +2 more potentially affected by CVE-2026-47143 via capstone (4.0.1)

capstone PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on capstone and may be impacted: - karton-autoit-ripper =1.0.0, =1.0.0, =1.1.0, =0.0.0.dev0, =0.2.0 Source cves: CVE-2026-47143 Source advisory: OSV:PYSEC-2026-3544...

afs-file-validator (1.0.1), apkutils (>=1.0.2, <=1.0.4) +43 more potentially affected by CVE-2025-15504 via lief (>=0.9.0, <=0.17.1)

lief PYPI version =0.9.0, =1.0.2, =1.0.0, =0.1.0, =1.0.0, =0.0.0, =0.4.2, =0.0.1, =2024.9.24, =5.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1 - famework 0.1.5 and more Source cves: CVE-2025-15504 Source advisory: GHSA-MJJP-XJFG-97WG...

EUVD-2023-24391

Malicious code in bioql PyPI...

Multi-Stage Malware Attack Uses .JSE and PowerShell to Deploy Agent Tesla and XLoader

A new multi-stage attack has been observed delivering malware families like Agent Tesla variants, Remcos RAT, and XLoader. "Attackers increasingly rely on such complex delivery mechanisms to evade detection, bypass traditional sandboxes, and ensure successful payload delivery and execution," Palo...

New Snake Keylogger Variant Leverages AutoIt Scripting to Evade Detection

A new variant of the Snake Keylogger malware is being used to actively target Windows users located in China, Turkey, Indonesia, Taiwan, and Spain. Fortinet FortiGuard Labs said the new version of the malware has been behind over 280 million blocked infection attempts worldwide since the start of...

Snake Keylogger Variant Hits Windows, Steals Data via Telegram Bots

The New Snake Keylogger variant targets Windows users via phishing emails, using AutoIt for stealth. Learn how it…...

New Crypto Trojan.AutoIt.1443 Hits 28,000 Users via Game Cheats, Office Tool

Trojan.AutoIt.1443 targets 28,000 users, spreading via game cheats and office tools. This cryptomining and cryptostealing malware bypasses antivirus…...

Unmasking ViperSoftX: In-Depth Defense Strategies Against AutoIt-Powered Threats

Trellix Global Defenders: Unmasking ViperSoftX: In-Depth Defense Strategies Against AutoIt-Powered Threats By James Murphy · August 29, 2024 There’s a common misconception that threat actors must always write complicated and custom code in every piece of their malware, skilfully evading defenses,...

ViperSoftX Malware Disguises as eBooks on Torrents to Spread Stealthy Attacks

The sophisticated malware known as ViperSoftX has been observed being distributed as eBooks over torrents. "A notable aspect of the current variant of ViperSoftX is that it uses the Common Language Runtime CLR to dynamically load and run PowerShell commands, thereby creating a PowerShell...

The Mechanics of ViperSoftX: Exploiting AutoIt and CLR for Stealthy PowerShell Execution

The Mechanics of ViperSoftX: Exploiting AutoIt and CLR for Stealthy PowerShell Execution By Sijo Jacob · July 9, 2024 This blog was also written by Mathanraj Thangaraju Threat Summary In the dynamic landscape of cyber threats, ViperSoftX has emerged as a highly sophisticated malware, adept at...

Sticky Werewolf Expands Cyber Attack Targets in Russia and Belarus

Cybersecurity researchers have disclosed details of a threat actor known as Sticky Werewolf that has been linked to cyber attacks targeting entities in Russia and Belarus. The phishing attacks were aimed at a pharmaceutical company, a Russian research institute dealing with microbiology and vacci...

afs-file-validator (1.0.1), apkutils (>=1.0.2, <=1.0.4) +29 more potentially affected by CVE-2024-31636 via lief (>=0.9.0, <=0.14.1)

lief PYPI version =0.9.0, =1.0.2, =1.0.0, =0.0.0, =0.4.2, =0.0.1, =2024.9.24, =5.0.0, =1.0.0, =0.0.1, =0.0.1, =2.0.0, =1.2.0, =1.5.0 and more Source cves: CVE-2024-31636 Source advisory: OSV:PYSEC-2024-280...

Cisco Secure Endpoint DoS (cisco-sa-clamav-dos-FTkhqMWZ)

A vulnerability in the Cisco Secure Endpoint AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to a logic error in the memory management of an affected device. An attacker could explo...

Battling a new DarkGate malware campaign with Malwarebytes MDR

First publicly reported in 2018, DarkGate is a Windows-based malware with a wide-range of capabilities including credential stealing and remote access to victim endpoints. Until recently, it was only seen being delivered through traditional email malspam campaigns. In late August 2023, however,...

Vietnamese Hackers Target U.K., U.S., and India with DarkGate Malware

Attacks leveraging the DarkGate commodity malware targeting entities in the U.K., the U.S., and India have been linked to Vietnamese actors associated with the use of the infamous Ducktail stealer. "The overlap of tools and campaigns is very likely due to the effects of a cybercrime marketplace,"...

DarkGate Malware Spreading via Messaging Services Posing as PDF Files

A piece of malware known as DarkGate has been observed being spread via instant messaging platforms such as Skype and Microsoft Teams. In these attacks, the messaging apps are used to deliver a Visual Basic for Applications VBA loader script that masquerades as a PDF document, which, when opened,...

Microsoft Teams used to deliver DarkGate Loader malware

Researchers have found a new method by which cybercriminals are spreading the DarkGate Loader malware. Until now, DarkGate was typically distributed via phishing emails. The malspam campaign used stolen email threads to lure victims into clicking a hyperlink, which downloaded the malware. But...