inno-setup-legitimate-installer-abuse
Pattern Definition
Threat actors repackage legitimate open-source installer frameworks (Inno Setup, NSIS, WiX) as malware droppers. The outer binary is benign software with a valid toolchain fingerprint; the payload is hidden inside an encrypted or compressed overlay archive that the installer extracts and executes at runtime. This leverages the trust and whitelisting commonly afforded to installer executables.
Variants
| Framework | Observed Version | Encryption | Masquerade |
|---|---|---|---|
| Inno Setup | 6.7.0 | LZMA2 + embedded key/nonce | Hardware driver updates (netsupport-inno-dropper), contact-indexing service (poabu-inno-dropper) |
| NSIS | 3.12 | LZMA + custom AES | Italian payment lure (unclassified-nsis-dropper) |
| IExpress | Windows built-in | CAB + password | AutoIt3 script extraction (asgardprotector) |
Cross-References
- version-info-masquerade — altering VS_VERSIONINFO to claim legitimate vendor identity
- netsupport-manager-abuse — deploying NetSupport Manager via repackaged Inno Setup
- gcleaner — distribution umbrella under which Inno Setup droppers have been observed
Detection Notes
- Inno Setup droppers share standard strings:
Inno Setup Setup Data (X.Y.Z),TSetupEncryptionKey,SetupLdr.e32 - The overlay is typically 3–12 MB of high-entropy data following a small PE image
innoextractwill fail on encrypted archives; success indicates an unencrypted (likely benign) installer- Version-info fields often contain lazy fabrications (future copyright years, nonsensical company names)