Luckily, there are free tools such as Exe2Aut which will decompile the executable. It turns out that this is a compiled AutoIt script – yet another layer wrapping the actual payload. Opening the executable in PEStudio, showing indicators of a compiled AutoIt script When taking a closer look at the file using PEStudio we see that this is not the case: In our case the culprit is the resource named Binary._D7D112F049BA1A655B5D9A1D0702DEE5, a normal Windows executable packed within the MSI. To obtain and analyze the executable, it can be extracted easily, using 7-Zip for example to open the MSI as an archive: That is only one of the first layers out of the many hiding the true essence of this malicious piece of code. This file is an installer created from a regular executable using a free tool called msi2exe, wrapping the “plain” malicious Windows executable as an installer. Once opened it downloaded an MSI file from a compromised website: In this case, it was a RAR archive containing two files – a benign text file and a Microsoft Word document weaponized with a DDE object. It was allegedly sent from an email account of an African energy company and just like countless similar attacks it had a malicious attachment. It was a classic malicious email titled “Quotation Request – EP”. Last week Minerva prevented an attack at one of our customers’ sites. Each of the layers hiding its functionality is a feature carefully selected by its “breeders” to improve its chances of surviving in the wild.

In the following post, we will go through the features of an information stealing malware. Attackers constantly check the effect of specific features of their offensive tools in relation to its survivability and “genetically engineer” the malware to improve its functionality. In our InfoSec universe the same biological principal applies to malware evolution.

AZORult is an info-stealing malware, that has evolved over time to become a multi layered feature, that improves its chance not to get caught.ĭarwin’s theory of evolution by natural selection is over 150 years old, but evolution may also occur as a result of artificial selection (also called selective breeding).

Why pestudio stopped running executable