{"id":28052,"date":"2013-08-02T01:37:56","date_gmt":"2013-08-02T08:37:56","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=28052"},"modified":"2025-05-28T18:41:19","modified_gmt":"2025-05-29T01:41:19","slug":"bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/","title":{"rendered":"Bitcoin Miners Use AutoIt-Complied Programs With Antianalysis Code"},"content":{"rendered":"<p style=\"text-align: justify;\">Last year, my colleague Itai Liba <a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/autoit-and-malware-whats-the-connection\">blogged<\/a> about the association between malware and AutoIt, a very convenient environment for malware and tools development. AutoIt allows both easy interface creation for rapid development and full Windows API access for whatever is not directly supported. We have seen an increase in the use of AutoIt scripts by malware authors and other bad guys to achieve their malicious ends.<\/p>\n<h2>How the Malicious Program Works<\/h2>\n<p style=\"text-align: justify;\">Recently, we have seen AutoIt-compiled programs that drop malicious Bitcoin mining programs. The malware authors are using not only encrypted code but are also focusing on antianalysis code to bypass common analysis tools\/systems used by security researchers. We have come across such multiple malicious tools on public forums that offer free premium accounts to online hosting services. Interestingly, if you run one of these malicious programs under VMware, the malware won\u2019t run and throws up an error message that looks genuine.<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/fake-error.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-28056\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/fake-error-300x131.png\" alt=\"fake-error\" width=\"300\" height=\"131\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/fake-error-300x131.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/fake-error.png 616w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">Looking at the preceding message, most of us will think that the program has problem with its Internet connection or firewall and few may think to examine this further. But this malicious program can detect VMware, Sandboxie, and other spy programs, and deliberately displays this error to avoid analysis by researchers. Let&#8217;s find the cause of this error. Searching strings in the main program tells us that the program has been compiled using AutoIt.<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/autoit_strings.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-28058\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/autoit_strings-300x175.png\" alt=\"autoit_strings\" width=\"300\" height=\"175\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/autoit_strings-300x175.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/autoit_strings.png 420w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">Decompiling the program using <a href=\"https:\/\/exe2aut.com\/\">Exe2Aut<\/a> gives us the full original script code along with the embedded encrypted file 1.crypt. The decompiled code has about 2,000 lines; most of the code is from the AutoIt wrapper for <a href=\"http:\/\/code.google.com\/p\/autoit-winhttp\/source\/browse\/trunk\/tags\/1.5.0.0\/WinHTTP.au3?r=2\">WinHTTP<\/a> functions called WinHTTP.au3. Here is snippet of exact code:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/winhttp_wrapper_autoit.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-28067\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/winhttp_wrapper_autoit-300x127.png\" alt=\"winhttp_wrapper_autoit\" width=\"300\" height=\"127\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/winhttp_wrapper_autoit-300x127.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/winhttp_wrapper_autoit-1024x435.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/winhttp_wrapper_autoit.png 1263w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">This code is not used at all. It&#8217;s here just to divert the attentions of researchers from looking into the main code. Here is the start-up code of this script:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/startup_auoit_code.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-28060\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/startup_auoit_code-300x178.png\" alt=\"startup_auoit_code\" width=\"300\" height=\"178\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/startup_auoit_code-300x178.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/startup_auoit_code.png 785w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">The preceding code displays splash screen and finds required paths by detecting the operating system. The code then checks for the Sandboxie process SbieCtrl.exe and if that process is detected exits by displaying a similar error message as seen earlier. The script then calls the function _checkforspy(). The program doesn\u2019t run any GUI offering free premium accounts and throws up a similar error message even if it runs on a clean system. Here is how the _checkforspy() code looks:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/check_for_spy_function.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-28062\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/check_for_spy_function-300x157.png\" alt=\"check_for_spy_function\" width=\"300\" height=\"157\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/check_for_spy_function-300x157.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/check_for_spy_function.png 434w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">This function calls two more functions: one to check if the system is a virtual PC and the second to find analysis programs such as SysTracer, oSPY, API Monitor, etc. by looking at open program windows. Here is the itsvirtualpc() function:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/vmware_checks_code.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-28063\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/vmware_checks_code-300x64.png\" alt=\"vmware_checks_code\" width=\"300\" height=\"64\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/vmware_checks_code-300x64.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/vmware_checks_code.png 843w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">The script checks for the presence of driver files VboxMouse.sys and vmmouse.sys to detect a virtual operating system and exits immediately by showing the \u201cConnection failed\u201d error. That\u2019s the reason this program will not run under VMware. We can\u2019t further analyze the malicious code. We could recompile the script by commenting out the antianalysis code with the help of <a href=\"http:\/\/www.autoitscript.com\/site\/autoit\/\">AutoIt<\/a>. Let\u2019s now look at the _install() function of the same code:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/install_autoit_code.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-28064\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/install_autoit_code-300x64.png\" alt=\"install_autoit_code\" width=\"300\" height=\"64\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/install_autoit_code-300x64.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/install_autoit_code.png 1013w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">The script drops GoogleSetup.exe in the Windows directory and installs the encrypted file 1.crypt by calling the _crypt_decryptfile function. The file 1.crypt is encrypted using the $CALG_AES_128 algorithm with the key fuck123. The script writes a registry key and runs GoogleSetup.exe. The dropped executable is again an AutoIt-compiled program that drops a CPU-miner program similar to this <a href=\"http:\/\/sourceforge.net\/projects\/cpuminer\/\">CPUminer<\/a>. Here is the code that drops and runs the Bitcoin-mining code:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/cpu_minor_code.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-28065\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/cpu_minor_code-300x174.png\" alt=\"cpu_minor_code\" width=\"300\" height=\"174\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/cpu_minor_code-300x174.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/cpu_minor_code-1024x595.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/cpu_minor_code.png 1418w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">The dropped miner program keeps on sending POST requests to the mining service shown below:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/cpuminer_post_requst.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-28066\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/cpuminer_post_requst-300x142.png\" alt=\"cpuminer_post_requst\" width=\"300\" height=\"142\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/cpuminer_post_requst-300x142.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/cpuminer_post_requst.png 872w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">Attackers have used AutoIt scripts for a long time, and it is gaining popularity due to its flexible and powerful nature. The output of the AutoIt script is a single executable, with no\u00a0dependencies, that contains a script and attached binaries. Although AutoIt-compiled programs are easy to decompile with the help of antianalysis code and encrypted malicious code, they can evade manual as well as automated analysis.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Last year, my colleague Itai Liba blogged about the association between malware and AutoIt, a very convenient environment for malware&#8230;<\/p>\n","protected":false},"author":674,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[4562,3923,180,3947],"coauthors":[3973],"class_list":["post-28052","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-ecommerce","tag-email-and-web-security","tag-malware","tag-virtualization"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Bitcoin Miners Use AutoIt-Complied Programs With Antianalysis Code | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Last year, my colleague Itai Liba blogged about the association between malware and AutoIt, a very convenient environment for malware and tools\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Bitcoin Miners Use AutoIt-Complied Programs With Antianalysis Code | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Last year, my colleague Itai Liba blogged about the association between malware and AutoIt, a very convenient environment for malware and tools\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2013-08-02T08:37:56+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-29T01:41:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/fake-error.png\" \/>\n\t<meta property=\"og:image:width\" content=\"616\" \/>\n\t<meta property=\"og:image:height\" content=\"271\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/\"},\"author\":{\"name\":\"McAfee\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\"},\"headline\":\"Bitcoin Miners Use AutoIt-Complied Programs With Antianalysis Code\",\"datePublished\":\"2013-08-02T08:37:56+00:00\",\"dateModified\":\"2025-05-29T01:41:19+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/\"},\"wordCount\":668,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/fake-error-300x131.png\",\"keywords\":[\"E-Commerce\",\"email and web security\",\"malware\",\"virtualization\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/\",\"name\":\"Bitcoin Miners Use AutoIt-Complied Programs With Antianalysis Code | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/fake-error-300x131.png\",\"datePublished\":\"2013-08-02T08:37:56+00:00\",\"dateModified\":\"2025-05-29T01:41:19+00:00\",\"description\":\"Last year, my colleague Itai Liba blogged about the association between malware and AutoIt, a very convenient environment for malware and tools\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/fake-error-300x131.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/fake-error-300x131.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Bitcoin Miners Use AutoIt-Complied Programs With Antianalysis Code\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\",\"name\":\"McAfee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"caption\":\"McAfee\"},\"description\":\"We're here to make life online safe and enjoyable for everyone.\",\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/x.com\/McAfee\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Bitcoin Miners Use AutoIt-Complied Programs With Antianalysis Code | McAfee Blog","description":"Last year, my colleague Itai Liba blogged about the association between malware and AutoIt, a very convenient environment for malware and tools","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Bitcoin Miners Use AutoIt-Complied Programs With Antianalysis Code | McAfee Blog","og_description":"Last year, my colleague Itai Liba blogged about the association between malware and AutoIt, a very convenient environment for malware and tools","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2013-08-02T08:37:56+00:00","article_modified_time":"2025-05-29T01:41:19+00:00","og_image":[{"width":616,"height":271,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/08\/fake-error.png","type":"image\/png"}],"author":"McAfee","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/"},"author":{"name":"McAfee","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa"},"headline":"Bitcoin Miners Use AutoIt-Complied Programs With Antianalysis Code","datePublished":"2013-08-02T08:37:56+00:00","dateModified":"2025-05-29T01:41:19+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/"},"wordCount":668,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/fake-error-300x131.png","keywords":["E-Commerce","email and web security","malware","virtualization"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/","name":"Bitcoin Miners Use AutoIt-Complied Programs With Antianalysis Code | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/fake-error-300x131.png","datePublished":"2013-08-02T08:37:56+00:00","dateModified":"2025-05-29T01:41:19+00:00","description":"Last year, my colleague Itai Liba blogged about the association between malware and AutoIt, a very convenient environment for malware and tools","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/fake-error-300x131.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/08\/fake-error-300x131.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/bitcoin-miners-use-autoit-complied-programs-with-antianalysis-code\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Bitcoin Miners Use AutoIt-Complied Programs With Antianalysis Code"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa","name":"McAfee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","caption":"McAfee"},"description":"We're here to make life online safe and enjoyable for everyone.","sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/x.com\/McAfee"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/28052","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/674"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=28052"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/28052\/revisions"}],"predecessor-version":[{"id":214657,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/28052\/revisions\/214657"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=28052"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=28052"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=28052"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=28052"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}