AmgdGocha / AutoIT-Remcos

A repo that contains scripts written to automate the de-obfuscation of the AutoIT malware that wraps a Remcos RAT agent, and to automate the extraction and decryption of Remcos configuration.

AutoIT-Remcos

This repo contains scripts written to automate the following:

1. De-obfuscation of the AutoIT script that wraps a Remcos RAT agent.
2. Automating Remcos config extraction and decryption.

Refer to this medium story: https://medium.com/@amgedwageh/analysis-of-an-autoit-script-that-wraps-a-remcos-rat-6b5b66075b87

An example of such AutoIT script: https://malshare.com/sample.php?action=detail&hash=d7fc2b593eac64ff4a46ba9f5864d875be3cb13ec8ef0327d781c5cd1e29b4ac