> Family · poabu-inno-dropper_

~/packetpursuit $ cat /intel/families/poabu-inno-dropper.md

typeentityconfidencelowcreated2026-06-15updated2026-06-15malware-familyinstallerdropperpesigningmasqueradinggcleanerevasion

poabu-inno-dropper

Overview

Inno Setup 6.7.0 installer family masquerading as a "contact indexing and telephony service" (product name poabu_2.1.11, company Drayages Gulgul Ltd). Authenticode-signed with a Sectigo code-signing chain that includes a certificate issued to Tim Kosse (FileZilla author), observed stolen in prior campaigns. The outer binary is a legitimate installer framework; threat logic lives in an 11+ MB encrypted LZMA overlay that is invisible to static tools without the embedded decryption key.

Confidence: low — single observed sample. May be a one-off campaign build or a variant of a broader gcleaner-distributed dropper cluster.

Build Stack

  • Toolchain: Inno Setup 6.7.0 (Delphi / Object Pascal compiler) ^[sample bb3fd6cd/strings.txt:7552]
  • Arch: PE32 (x86), Windows GUI subsystem ^[sample bb3fd6cd/file.txt]
  • Import Table: Standard IAT intact; delay-imports for kernel32.dll and user32.dll ^[sample bb3fd6cd/pefile.txt:DelayImport]
  • Overlay: 11.34 MB encrypted LZMA-compressed Inno Setup archive ^[sample bb3fd6cd/binwalk.txt]
  • Signing: Authenticode-signed (signed=true); Sectigo chain with leaf CN Tim Kosse ^[sample bb3fd6cd/rabin2-info.txt]
  • Masquerade: Fabricated version info claiming "poabu_2.1.11" by "Drayages Gulgul Ltd" with copyright year 2058 ^[sample bb3fd6cd/exiftool.json]

Capabilities

  • inno-setup-legitimate-installer-abuse
  • lzma-encrypted-overlay-archive
  • authenticode-code-signing-stolen-cert
  • version-info-masquerade
  • contact-service-social-engineering
  • gcleaner-distribution-pipeline

Deploy / TTPs

Technique ID Evidence
Masquerading T1036.002 "Service responsible for contacts indexing and other telephon" by "Drayages Gulgul Ltd" ^[sample bb3fd6cd/exiftool.json]
Software Packing T1027.002 Encrypted LZMA(2) Inno Setup archive with embedded key/nonce ^[sample bb3fd6cd/strings.txt:7058-7059]
Ingress Tool Transfer T1105 Drops unknown payload via legitimate installer framework ^[/intel/analyses/bb3fd6cd4a7ad6fe91cf30362157569837315dec25ec15fc0733b2e9307fa9ce.html]
Code Signing T1553.002 Valid Authenticode signature with Sectigo chain ^[sample bb3fd6cd/rabin2-info.txt]

Variants / Aliases

  • poabu-inno-dropper — this wiki label
  • mix4.file — OpenCTI distribution label
  • dropped-by-gcleaner — OpenCTI umbrella tag

Notable Analyses

  • /intel/analyses/bb3fd6cd4a7ad6fe91cf30362157569837315dec25ec15fc0733b2e9307fa9ce.html — bb3fd6cd, static-only, no CAPE detonation

Related