I published the following diary on isc.sans.org: “AutoIT based malware back in the wild“.
One week ago I wrote a diary with an analysis of a malicious RAR archive that contained an AutoIT script. The technique was not new but I was curious to see if this was a one-shot or not. To search for juicy samples, VirusTotal Intelligence or â€œVTIâ€ is a nice source. Thanks to the â€œRetro Huntâ€ feature, it is possible to search for specific samples that were submitted. The search conditions are based on YARA rules… [Read more]