{
  "family": "aauto",
  "sample_count": 13,
  "category": "trojan",
  "description": "AAuto (classified across antimalware research as Trojan:Win32/AAuto and TrojanDownloader:Win32/AAuto) is an automation-scripting loader trojan compiled using the AAuto/AAuto-Quicker rapid application development environment. Threat actors leverage AAuto's compact scripting syntax and native Windows API bindings to construct lightweight malware loaders that easily evade traditional static signatures. AAuto scripts drop embedded PE payloads into %APPDATA%, inject malicious DLLs into system processes, and establish autostart persistence via Windows registry Run entries. It communicates with remote command-and-control servers via HTTP/HTTPS to fetch additional secondary malware modules.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/AAuto",
    "TrojanDownloader:Win32/AAuto",
    "Win32/AAuto",
    "AAuto Script Loader",
    "Trojan.AAuto"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/AAuto?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "AAuto is a scripting loader trojan that uses the AAuto development environment to evade detection and deliver secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "Why do attackers compile malware with AAuto?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "AAuto compiles into clean, lightweight standalone executables with native Windows API access, bypassing static heuristic filters."
      }
    },
    {
      "@type": "Question",
      "name": "What persistence methods does AAuto employ?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates autostart registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and registers scheduled tasks."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary malware is typically delivered by AAuto?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It commonly delivers cryptocurrency miners, remote access trojans (RATs), and password stealers."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders detect AAuto trojans?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Monitor process creation events in %APPDATA% and inspect outbound HTTP connections for unusual scripted User-Agent strings."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059",
    "T1105",
    "T1547.001",
    "T1055",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies created by the adware.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Aauto frequently uses GPOs and watchdog services to immediately reinstall itself.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or access to internal portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/AAuto",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/AAuto"
    },
    {
      "name": "Trend Micro Security Research - Trojan.Win32.AAuto Overview",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.aauto"
    },
    {
      "name": "MITRE ATT&CK - Command and Scripting Interpreter (T1059)",
      "url": "https://attack.mitre.org/techniques/T1059/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}