ACRStealer: IExpress-Staged AutoIt3 Proper.a3x Execution Chain

Duo Tech@duotech

•updated Aug 17, 2026•0•0•1

Detects execution of AutoIt3.exe running the Proper.a3x payload following extraction by the IExpress self-extractor setup_patched.exe (or from its IXP000.TMP staging path) — the initial infection chain observed in the ACRStealer/Amatera BYOVD campaign.