We observed that both of them are packed with the same packer and use the same payload delivery mechanism. Zscaler Cloud Sandbox captured the CyberGate RAT and RedLine stealer successfully. The Zscaler ThreatLabZ team is closely monitoring the developments on these campaigns to ensure coverage.įigure 1: Hits of AutoIt-based malware in the past month.

We observed several hits for the AutoIt malware involving various malware families, including AZOrult, Xtreme RAT, Taurus stealer, RedLine Stealer, and CyberGate RAT. We will shed light on the custom protocol used by the Cybergate RAT.īelow is the detection timeline for AutoIt malware campaigns in the past month. We also observed the usage of custom C&C protocols to exfiltrate sensitive information.

This blog will walk you through a detailed analysis of the payload delivery mechanism, capabilities, and Command and Control (C&C) communication. Along similar lines, we recently came across a new malware campaign that uses a similar AutoIt script to deliver a new variant of the CyberGate RAT and RedLine stealer. In our most recent blog, we had detailed a malware campaign that uses a malicious document (DOC) file to deliver an AutoIt script which, in turn, delivers the Taurus stealer to steal credentials, cookies, history, system info, and more.

Download cybergate rat