Reverse engineering/forensics with autoit based malware

Anyone here have any experience with this?

Some context:
I'm looking into some software that was developed with the autoit package. Autoit allows users to develop code using their scripting language and provides utilities that can wrap that script and the vm required into a binary executable. The script is obfuscated in the binary and isn't actually compiled until the application is run so that makes dissecting it with an editor/ida pro that much more annoying.

I've found a decompiler that should handle the software in question but it is of course having issues. Has anyone here ever dealt with this or something similar? Does anyone want to poke at this problem with me?

Quote:

---

Originally Posted by Juridian

and provides utilities that can wrap that script and the vm required into a binary executable. The script is obfuscated in the binary and isn't actually compiled until the application is run so that makes dissecting it with an editor/ida pro that much more annoying.

---

All I can say is .... holy siht!!!

Quote:

---

/
Does anyone want to poke at this problem with me?

---

I wish I knew enough to :(

MLF

If nothing else, I'm compiling all of the resources I find and documenting what I'm doing so I can stick it up on my blog. I can kick you a link later if you want to poke around with it.

Hey Juridian,

I can't say I have much experience with reversing AutoIt... but I do have some experience with reversing and some experience with AutoIt...

I'd actually be really interested in seeing the executable you're working with and taking a stab at it.

HT

I am totally interested in this....I just dont have experience enough to contribute much.

Makes the case of not running as admin of the machine ...as I believe it would need the permisions to edit the registry.

MLF

I used to write some autoit stuff, pm me what ever you are working on and ill take a look.

Not much of a programmer however it looks very interesting.

So wouldnt this type of program...if someone wrote it to be malicious in nature be hard for an av to detect until the malware was active.

Isnt this how that AV2008 crap gets onto machines???

I have seen it on machines with updated AV software and then had to remove using a different tool.

Very interesting...

MLF

Hmmmm,


I haven't used it for ages, but it used to have a decompiler shipped with it. Then the author took it out with later versions.

This might work, but like I said its been a long time and I haven't tried it:

http://myauttoexe.angelfire.com/index2.html

Yes it still comes with the decompiler, but you can password protect them with a passphrase so they "cannot" be decrypted with out it.

Here is another link:

http://leechermods.blogspot.com/2008...nd-script.html

I think that the decompilers are third party these days...................... and I don't know what it says in the EULA.:eek:

When I used it, it came with its own decompiler/unpacker. I used to use it to mod scripts other people had written :D

Quote:

---

If nothing else, I'm compiling all of the resources I find and documenting what I'm doing so I can stick it up on my blog.

---

If i may ask, what is the address of your blog? It seems it may be an interesting read :)


CTO

Hi CTO,

The link is in his sig:

http://juridian.com/blogs/x/default.aspx

;)

Duh! I knew that ;)

Cheers bud

This Script will Reverse it:

http://www.nerdbucket.com/mirrors/my...opensource.zip