poabu-inno-dropper: bb3fd6cd — Authenticode-signed Inno Setup 6.7.0 masquerading as contact-indexing service

Executive Summary

A 13 MB PE32 Inno Setup installer compiled Fri Jan 2 2026 and Authenticode-signed with a Sectigo code-signing chain that includes "Tim Kosse" (FileZilla author). The version-info claims to be "poabu_2.1.11" by "Drayages Gulgul Ltd" — a fabricated identity for a "Service responsible for contacts indexing and other telephon". The 11.34 MB encrypted LZMA overlay hides the actual payload; no C2 strings or malicious imports are exposed in the outer binary. OpenCTI tags it dropped-by-gcleaner / mix4.file. Static-only analysis — no CAPE detonation available.

What It Is

Version-info masquerade:

• CompanyName: Drayages Gulgul Ltd ^[exiftool.json:37]
• ProductName: poabu_2.1.11 ^[exiftool.json:42]
• FileDescription: Service responsible for contacts indexing and other telephon ^[exiftool.json:38]
• FileVersion: 70.63.35 ^[exiftool.json:39]
• LegalCopyright: © 2058 Drayages Gulgul Ltd. All rights reserved. ^[exiftool.json:40]
• Comments: This installation was built with Inno Setup. ^[exiftool.json:36]

Signing: Authenticode-signed (signed=true per rabin2-info). The certificate chain includes Sectigo Public Code Signing Root R46 → Sectigo Public Code Signing CA R36 → leaf CN Tim Kosse ^[strings.txt:15620-15683]. Tim Kosse is the author of FileZilla; this certificate has been observed stolen in prior malware campaigns (e.g., AsgardProtector variants). The signature is timestamped and valid at parse time.

How It Works

The binary is a standard Inno Setup 6.7.0 self-extracting installer ^[strings.txt:7552]. The PE header describes a ~1.07 MB image (SizeOfImage = 0x106000); the remaining ~11.34 MB is an encrypted LZMA-compressed Inno Setup archive stored in the file overlay ^[binwalk.txt:8].

Inno Setup internals observed:

• Setup data format 6.7.0, messages format 6.5.0 (Unicode) ^[strings.txt:7552-7553]
• TSetupEncryptionKey and TSetupEncryptionNonce present ^[strings.txt:7058-7059]
• TSetupPrivilegesRequired = admin (inferred from Inno Setup defaults) ^[strings.txt:7066]
• Standard [Run] entries and file-extraction routines implied by NumRunEntries, NumInstallDeleteEntries ^[strings.txt:7158-7159]
• No custom [Code] (Pascal script) functions observed in strings — likely a pure data-driven installer

Import table: Entirely benign Win32 APIs. No WinInet, WinHTTP, WS2_32, or Crypt32 imports ^[pefile.txt:435-500]. Network and crypto operations, if any, live inside the encrypted overlay payload and are invisible statically.

No anti-analysis: No debugger checks, VM detection, or sandbox evasion in the outer binary. The only evasion is toolchain legitimacy — the installer itself is benign software repurposed for malicious distribution.

Decompiled Behavior

Ghidra import queued; analysis not complete at time of report. The outer binary is the Inno Setup 6.7.0 stub — a well-understood open-source installer framework. Reverse engineering the stub would add no value; the threat logic lives in the encrypted overlay.

Radare2 analysis (aa) recovered 6,885 functions, mostly Inno Setup / Delphi RTL standard routines. Entry point at 0x4B1E60 branches into SetupLdr.e32 initialization, resource enumeration, and LZMA decompression before jumping to the extracted setup engine.

C2 Infrastructure

None recoverable statically. The outer binary contains no URLs, IPs, domains, mutex names, or named pipes. The payload is encrypted inside the 11.34 MB overlay and would require:

1. Decrypting the Inno Setup archive with the embedded key/nonce, or
2. Runtime detonation (CAPE currently unavailable — no Windows guest)

innoextract fails with "Setup loader checksum mismatch" and "Could not determine setup data version", confirming the archive is encrypted with a non-default key.

Interesting Tidbits

• Stolen certificate chain: The "Tim Kosse" CN in the Sectigo chain matches certificates observed in the asgardprotector IExpress SFX dropper family (stolen FileZilla cert). This suggests certificate reuse across unrelated distribution operations. ^[strings.txt:15620-15683]
• Fabricated copyright year 2058: A lazy placeholder in the version info, indicating automated or low-effort builder configuration. ^[exiftool.json:40]
• "poabu" product name: No known legitimate software by this name. The string does not appear elsewhere in the corpus. May be a campaign/builder identifier.
• "Drayages Gulgul Ltd": Nonsense company name — "Drayage" is a logistics term, "Gulgul" has no commercial presence. Typical of masquerade generators.
• FileDescription telephon truncation: The description string is truncated at 56 chars ("telephon" not "telephony"), suggesting a fixed-width field copy-paste error.
• GCleaner distribution tag: OpenCTI labels dropped-by-gcleaner and mix4.file place this sample in the same distribution pipeline as euone, bb5file, and uniqfile. The gcleaner label is an umbrella, not a family. ^[triage.json]

How To Mess With It (Homelab Replication)

Build a comparable installer:

1. Download Inno Setup 6.7.0 from jrsoftware.org.
2. Create an .iss script with fabricated version info:

   [Setup]
   AppName=poabu_2.1.11
   AppVersion=70.63.35
   AppPublisher=Drayages Gulgul Ltd
   AppCopyright=© 2058 Drayages Gulgul Ltd
   DefaultDirName={autopf}\poabu
   OutputBaseFilename=setup
   Encryption=yes
   Password=YourPasswordHere
   

3. Add a benign payload (e.g., calc.exe) under [Files].
4. Compile with ISCC. The resulting setup.exe will match this sample's outer structure: PE32, Inno Setup 6.7.0 strings, encrypted LZMA overlay, standard IAT.
5. For extra fidelity, sign with any code-signing certificate (self-signed or stolen-test).

Verification: Run strings -n 10 setup.exe | grep -i "Inno Setup" — should show Inno Setup Setup Data (6.7.0). Run binwalk setup.exe — should show LZMA compressed data in the overlay.

Deployable Signatures

YARA Rule

rule PoabuInnoDropper {
    meta:
        description = "Inno Setup 6.7.0 installer with poabu/Drayages Gulgul masquerade"
        author = "PacketPursuit SOC"
        date = "2026-06-15"
        sha256 = "bb3fd6cd4a7ad6fe91cf30362157569837315dec25ec15fc0733b2e9307fa9ce"
    strings:
        $inno = "Inno Setup Setup Data (6.7.0)" ascii wide
        $product = "poabu_" ascii wide
        $company = "Drayages Gulgul" ascii wide
        $desc = "Service responsible for contacts indexing" ascii wide
        $copyright = "2058 Drayages Gulgul" ascii wide
        $tim_kosse = "Tim Kosse" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $inno and
        (2 of ($product, $company, $desc, $copyright) or $tim_kosse)
}

Sigma Rule

title: Inno Setup Installer with Suspicious Masquerade
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\setup.exe'
        CommandLine|contains:
            - 'poabu'
            - 'Drayages'
    condition: selection
falsepositives:
    - None known (these strings are fabricated)
level: high

IOC List

Behavioral Fingerprint

This binary presents as a standard Windows GUI application. Upon launch it extracts an encrypted LZMA archive from its own overlay into a temporary directory, decrypts it using the embedded TSetupEncryptionKey, and executes the contained files. No network connections are initiated by the outer stub; any C2 behavior would be contained within the extracted payload. The binary carries a valid Authenticode signature from a Sectigo code-signing chain. Version-info fields claim the product is "poabu_2.1.11" by "Drayages Gulgul Ltd" with a copyright year of 2058.

Detection Signatures (capa→ATT&CK)

No capa capabilities identified — capa flagged the binary as an installer and aborted deep analysis ^[capa.txt:1-20]. The installer file limitation rule fired.

References

• OpenCTI artifact ID: 85a5a66c-a8c2-4f0c-8577-18c2300b6f57
• MalwareBazaar tags: dropped-by-gcleaner, mix4.file
• Related wiki pages: gcleaner, poabu-inno-dropper, netsupport-inno-dropper, asgardprotector, version-info-masquerade, inno-setup-legitimate-installer-abuse
• Inno Setup 6.7.0: https://jrsoftware.org/isdl.php

Provenance

Analysis derived from:

• file.txt — file(1) output
• pefile.txt — pefile.py full parse (Python 3.12, pefile 2024.8.26)
• rabin2-info.txt — radare2 rabin2 -I (radare2 5.9.0)
• exiftool.json — ExifTool 12.76 metadata extract
• strings.txt — strings -n 6 (GNU binstrings 2.42)
• capa.txt — Mandiant capa v9.1.0 (installer limitation warning)
• binwalk.txt — binwalk v2.3.4 signature scan
• triage.json — internal triage pipeline schema v1
• dynamic-analysis.md — CAPE sandbox status (skipped, no Windows guest)
• radare2 MCP — aa analysis, imports list, strings list
• Manual hex inspection of certificate chain and version-info resource