Gabriel Cirlig & Stefan Tanase, Ixia

AutoHotkey is an open-source scripting language for Windows, originally aimed at providing easy ways for users of most levels of computer skill to automate tasks in Windows applications—through keyboard shortcuts, fast macro-creation, and software automation. But its list of features doesn’t stop there. It can set up Windows Event Hooks, inject VBScript/JScript, and even inject DLLs in other process’ memory. Being a reputable tool, it has gathered over the years a sizeable community that has been able to push its interpreter (an 800KB binary blob) into the whitelists of most of the antivirus vendors.

However, it has also attracted the attention of the wrong type of crowd. Malware authors have started using this scripting engine to fly under the radar and drop a varied range of payloads without triggering any antivirus (AV) alarms.

In this talk I will be focusing on presenting ways that this tool can be used for malicious purposes, from droppers to keyloggers that use covert channels such as DNS to exfiltrate data. A brief article that presents the first part can be found here as well.