Threat video1:00
WorldProxyPool Trojanized Inno Setup: Detection & IOCs
Trojanized Inno Setup installers drop WorldProxyPool, CharityEngine and AW Manager in one session. Get 9 detection rules, 29 IOCs and a free Splunk SPL rule.
Read the full threat intel for WorldProxyPool Trojanized Inno Setup: Detection & IOCs →
Chapters
- 0:00The hookFake installer delivers monetization malware.
- 0:04The storyUsers seeking cracked software download fake installers.
- 0:10Attack pathInno wrapper stages temporary runners.
- 0:22AttributionNo threat actor is attributed.
- 0:26Indicators of compromise26 indicators to hunt: 15 domains, 7 SHA-256 hashes and 1 file name, and more.
- 0:35MITRE ATT&CK techniques8 ATT&CK techniques, from execution to impact.
- 0:39Remediation4 steps now: Hunt for HTTP requests containing d=inno with r=offer_execution or r=offer_execution_fail.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fake installer delivers monetization malware.
0:05Users seeking cracked software download fake installers.
0:10Inno wrapper stages temporary runners.
0:13Callback retrieves three malware branches.
0:15Proxyware routes third-party traffic.
0:18Device hijacked for monetization.
0:22No threat actor is attributed. Confidence: low.
0:2626 indicators to hunt: 15 domains, 7 SHA-256 hashes and 1 file name, and more.
0:358 ATT&CK techniques, from execution to impact.
0:404 steps now: Hunt for HTTP requests containing d=inno with r=offer_execution or r=offer_execution_fail.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.