Distribution of Zephyr CoinMiner Using Autoit

**Executive Summary:** AhnLab ASEC identified a multi-stage CoinMiner campaign that distributes a Zephyr miner inside a compressed NSIS installer named WINDOWS_PY_M3U_EXPLOIT_2024.7z; the package drops and executes Javascript which decodes a Base64 AutoIt executable that extracts 32/64-bit miner binaries and installs Helper.exe to %USER%/AppData/Roaming. The report documents the miner's pool (zeph.kryptex.network:8888), hardcoded wallet, the malware execution flow, detection names (V3 aliases), and MD5 IOCs to support detection and remediation efforts.