Executable
Script
Contributors:
Gabriel Mathenge - @_theVIVI
Description:
An .a3x file is an AutoIt v3 compiled script. An .a3x file can be used with the standalone and digitally signed AutoIt binary (AutoIt3.exe or AutoIt3_x64.exe) to execute malicious code in the context of a signed/trusted process.
OS:
Windows
Recommendation:
Monitor and disallow .a3x files. Monitoring for the unexpected presence and execution of the AutoIt3.exe binary might also be useful.
Resources:
File Samples: