{"id":29421,"date":"2013-09-19T10:46:03","date_gmt":"2013-09-19T17:46:03","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=29421"},"modified":"2025-06-08T19:15:06","modified_gmt":"2025-06-09T02:15:06","slug":"vertexnet-botnet-hides-behind-autoit","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/","title":{"rendered":"Vertexnet Botnet Hides Behind AutoIt"},"content":{"rendered":"<p>Recently we found some new malware samples using AutoIt to hide themselves. On further analysis we found that those sample belong to the Vertexnet botnet. They use multiple layers of obfuscation; once decoded, they connect to a control server to accept commands and transfer stolen data.<\/p>\n<h2>What to Know<\/h2>\n<p>This sample is packed using a custom packer. On execution it drops three files in the %TEMP% folder.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-29423\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex1-300x47.png\" alt=\"vertex1\" width=\"300\" height=\"47\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex1-300x47.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex1.png 782w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>These files are compiled using aut2exe. The malware next executes the file botnet.exe from the temp folder. This file is written in AutoIt. We can easily decompile it using Exe2Aut.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/Vertex2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-29424\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/Vertex2-300x94.png\" alt=\"Vertex2\" width=\"300\" height=\"94\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/Vertex2-300x94.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/Vertex2-1024x323.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/Vertex2.png 1768w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>This file uses various obfuscated variables that are encrypted using a simple algorithm:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex3.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-29425\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex3-300x125.png\" alt=\"vertex3\" width=\"300\" height=\"125\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex3-300x125.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex3.png 440w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>Decoding the variables, we can see that this script calls various Windows APIs using the Autoit DLL functions DllStructCreate, DllStructGetPtr, DllCall, etc.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex12.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-29426\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex12-300x69.png\" alt=\"vertex12\" width=\"300\" height=\"69\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex12-300x69.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex12-1024x238.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex12.png 1498w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>Searching Google, we easily found the original code likely to be used in the preceding script with obfuscation:\u00a0 <a href=\"http:\/\/www.autoitscript.com\/forum\/topic\/99412-run-binary\/\">http:\/\/www.autoitscript.com\/forum\/topic\/99412-run-binary\/<\/a><\/p>\n<p>(The preceding post containing information on how to run an executable from memory is old. It was made\u00a0 around 2009 on autoitscript.com.)<\/p>\n<p>The technique of running an executable from memory through an AutoIt script is well documented on this link. To summarize, it first creates a process with with the CREATE_SUSPENDED flag:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex4.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-29427\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex4-300x88.png\" alt=\"vertex4\" width=\"300\" height=\"88\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex4-300x88.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex4-1024x301.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex4.png 1300w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>Next it uses GetThreadContext to get the CONTEXT structure:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex5.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-29428\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex5-300x66.png\" alt=\"vertex5\" width=\"300\" height=\"66\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex5-300x66.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex5-1024x226.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex5.png 1146w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>Subsequently, it uses WriteProcessMemory,SetThreadContext and allocates memory for the data.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex6.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-29429\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex6-300x74.png\" alt=\"vertex6\" width=\"300\" height=\"74\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex6-300x74.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex6-1024x254.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex6.png 1173w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>Then it resumes the thread:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex7.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-29430\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex7-300x61.png\" alt=\"vertex7\" width=\"300\" height=\"61\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex7-300x61.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex7-1024x210.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex7.png 1113w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>After dumping the data in WriteProcessMemory calls, we get a Visual Basic file, which uses the RunPE method to execute the payload:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex8.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-29431\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex8-300x40.png\" alt=\"vertex8\" width=\"300\" height=\"40\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex8-300x40.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex8.png 487w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>The final payload is VertexNet 1.2 , which we discovered from the strings it contains:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex10.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-29438\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex10-300x164.png\" alt=\"vertex10\" width=\"300\" height=\"164\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex10-300x164.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex10.png 653w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><br \/>\nOn executing the final payload, it communicates with the control server:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex11.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-29434\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex11-300x27.png\" alt=\"vertex11\" width=\"300\" height=\"27\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex11-300x27.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex11-1024x95.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex11.png 1184w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>We see an constant increase in AutoIt malware because of its ease of use. We have found that malware authors always use ready-made tools and quickly adapt to new tricks.<\/p>\n<p>McAfee customers are protected against this threat by IPS signature:\u00a0BOT: VertexNet Bot Activity Detected.<\/p>\n<p>I would like to thank my colleague Arunpreet Singh for his help with the analysis of this threat.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Recently we found some new malware samples using AutoIt to hide themselves. On further analysis we found that those sample&#8230;<\/p>\n","protected":false},"author":612,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[49,180],"coauthors":[2095],"class_list":["post-29421","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-botnet","tag-malware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Vertexnet Botnet Hides Behind AutoIt | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Recently we found some new malware samples using AutoIt to hide themselves. On further analysis we found that those sample belong to the Vertexnet botnet.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Vertexnet Botnet Hides Behind AutoIt | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Recently we found some new malware samples using AutoIt to hide themselves. On further analysis we found that those sample belong to the Vertexnet botnet.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2013-09-19T17:46:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-09T02:15:06+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"782\" \/>\n\t<meta property=\"og:image:height\" content=\"124\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Hardik Shah\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@hardik05\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Hardik Shah\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/\"},\"author\":{\"name\":\"Hardik Shah\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/99cb905e9b4051dfea96a7752dea4342\"},\"headline\":\"Vertexnet Botnet Hides Behind AutoIt\",\"datePublished\":\"2013-09-19T17:46:03+00:00\",\"dateModified\":\"2025-06-09T02:15:06+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/\"},\"wordCount\":362,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex1-300x47.png\",\"keywords\":[\"botnet\",\"malware\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/\",\"name\":\"Vertexnet Botnet Hides Behind AutoIt | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex1-300x47.png\",\"datePublished\":\"2013-09-19T17:46:03+00:00\",\"dateModified\":\"2025-06-09T02:15:06+00:00\",\"description\":\"Recently we found some new malware samples using AutoIt to hide themselves. On further analysis we found that those sample belong to the Vertexnet botnet.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex1-300x47.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex1-300x47.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Vertexnet Botnet Hides Behind AutoIt\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/99cb905e9b4051dfea96a7752dea4342\",\"name\":\"Hardik Shah\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/b151596c8b1a8dc9b25ec3b19ccfd8c0\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2b87a13b8b83a589e5494d7db597ad6a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2b87a13b8b83a589e5494d7db597ad6a?s=96&d=mm&r=g\",\"caption\":\"Hardik Shah\"},\"description\":\"Hardik Shah, a Senior Research Engineer in McAfee Labs, is an experienced security researcher and technology evangelist. He has extensive experience with exploits, malware analysis, and various IPS engines. Shah enjoys figuring out ways to protect customers from the latest threats. Prior to McAfee, he worked with the IPS research team at Symantec. You can follow him on twitter at @hardik05\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/hardik05\/\",\"https:\/\/x.com\/hardik05\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/hardik-shah\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Vertexnet Botnet Hides Behind AutoIt | McAfee Blog","description":"Recently we found some new malware samples using AutoIt to hide themselves. On further analysis we found that those sample belong to the Vertexnet botnet.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Vertexnet Botnet Hides Behind AutoIt | McAfee Blog","og_description":"Recently we found some new malware samples using AutoIt to hide themselves. On further analysis we found that those sample belong to the Vertexnet botnet.","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2013-09-19T17:46:03+00:00","article_modified_time":"2025-06-09T02:15:06+00:00","og_image":[{"width":782,"height":124,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/09\/vertex1.png","type":"image\/png"}],"author":"Hardik Shah","twitter_card":"summary_large_image","twitter_creator":"@hardik05","twitter_site":"@McAfee","twitter_misc":{"Written by":"Hardik Shah","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/"},"author":{"name":"Hardik Shah","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/99cb905e9b4051dfea96a7752dea4342"},"headline":"Vertexnet Botnet Hides Behind AutoIt","datePublished":"2013-09-19T17:46:03+00:00","dateModified":"2025-06-09T02:15:06+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/"},"wordCount":362,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex1-300x47.png","keywords":["botnet","malware"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/","name":"Vertexnet Botnet Hides Behind AutoIt | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex1-300x47.png","datePublished":"2013-09-19T17:46:03+00:00","dateModified":"2025-06-09T02:15:06+00:00","description":"Recently we found some new malware samples using AutoIt to hide themselves. On further analysis we found that those sample belong to the Vertexnet botnet.","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex1-300x47.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/09\/vertex1-300x47.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/vertexnet-botnet-hides-behind-autoit\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Vertexnet Botnet Hides Behind AutoIt"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/99cb905e9b4051dfea96a7752dea4342","name":"Hardik Shah","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/b151596c8b1a8dc9b25ec3b19ccfd8c0","url":"https:\/\/secure.gravatar.com\/avatar\/2b87a13b8b83a589e5494d7db597ad6a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2b87a13b8b83a589e5494d7db597ad6a?s=96&d=mm&r=g","caption":"Hardik Shah"},"description":"Hardik Shah, a Senior Research Engineer in McAfee Labs, is an experienced security researcher and technology evangelist. He has extensive experience with exploits, malware analysis, and various IPS engines. Shah enjoys figuring out ways to protect customers from the latest threats. Prior to McAfee, he worked with the IPS research team at Symantec. You can follow him on twitter at @hardik05","sameAs":["https:\/\/www.linkedin.com\/in\/hardik05\/","https:\/\/x.com\/hardik05"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/hardik-shah\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/29421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/612"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=29421"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/29421\/revisions"}],"predecessor-version":[{"id":215277,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/29421\/revisions\/215277"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=29421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=29421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=29421"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=29421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}