Lalith- AutoIT scripts have been around for quite a while and as a legitimate scripting language can (and has) been used for many useful and noble purposes. Sadly Blackhats have also been aware of the power of the script and for a number of years have incorporated AutoIt into malware.
Although one can make simple things like trojan downloaders, keyloggers, etc quite easily with the script, recently AutoIT can be found in things like Zeus and some Critoni Phase 3 ransomware. We also found that the POS skimmers that plagued a major Retailers recent breach was generated by an AutoIT script. The scripts can be so constructed to do things from the banal (like dropping another script written in vbs to act as a downloader) to the more complex (like Process Hollowing- something legitimate like svchost will be created with an encrypted Portable Executable (PE) attached to it. The legit svchost is temporarily suspended while the PE malware is written into memory; then the legit process is restarted and runs the malware by itself). This malware can do many other things like turn off System Restore, regedit, task manager, as well as appending text to sent emails, FaceBook entries, etc. Other things are possible but I'm sure you get the idea.
The issue with detection of AutoIT malware is that it can be changed so easily any definition based security solution just can't keep up. A good BlackHat will write the script with much nonsense (verbose) code, so by deleting some of it virtually a new file can be created. This is important in the case of something like a keylogger that must connect to a C&C. As most malware servers will only be on line for 12 hours or so, a new version can be easily created for when a new server is needed. The issue here is that most AV products really aren't good at catching malware in the first few hours of creation, and furthermore many products can't (and won't) distinguish between a valid script and a malicious one. Case in point are both of the most popular second opinion scanners, MB and HMP- both are horrid against scripts.
A further complication is that many of the scripts will include (drop) a hidden command line file that will (especially when a malicious vbs daughter is the malware vector) replicate the malware just in case something like Emsisoft Emergency Kit detects and deletes something.
As far as protecting against these guys, obviously a definition based defense will be of little value. Something simple like WinPatrol will alert to an autostart entry being created, and a firewall with Outbound Notification will alert you to something like a downloader or keylogger as it tries to transmit to its C&C. In both cases the user will notice right away that something nasty is occurring. Of course a security application with an auto-sandboxing feature will indeed protect as scripts will be isolated and prevented from doing harm (although many malware of this type have VM aware functionality- they won't run in a VM, but will in a real system. This is included to fool IT professionals).
But the best defense is to throw away your computer. I've found that this is 100% effective against all forms of malware (except things you get by Phone and Post, so stop mail delivery and disconnect the telephone also).
