Inno Setup installer that contains a malicious native x64 payload

Conclusion

Scope and Coverage

Examined artifacts

• Uploaded root: /workspace/1cbb2f40b21153e4c6f978fa119671fc97657ac0f3c48b7121fc5ec865053cb0.bin

• Derived child analyzed in depth: /workspace/carved_pes/pe_013adb10.bin

• Other derived children: 10 additional valid carved PE files were identified from the installer body; several were screened for the key indicators found in the malicious child.

Coverage notes

• Root PE loader coverage from bintools_load_binary: 99%, with 13 unattributed regions and 32 unresolved indirect branches.

• Malicious child coverage from bintools_load_binary: 98%, with 168 unattributed regions and 143 unresolved indirect branches.

• Those gaps limit absence-based claims, but they do not weaken the positive malicious findings because the core theft, exfiltration, injection, and anti-analysis paths were directly observed in decompiled code.

• Dynamic execution was not required because static evidence already established malicious behavior.

Artifact Relationships and Behavioral Sequence

Relationship

Behavioral sequence supported by code

1. The installer contains embedded native executables; one embedded x64 PE carries the theft logic.

2. The malicious child starts in sub_1400191c0 and creates mutex build_cvbfihjudpnetx to enforce a single instance.

3. It initializes WinINet API pointers in sub_14000d3b0 and suppresses execution if a debugger is present.

4. It creates a working directory and launches multiple collection routines:
• wallets: sub_1400dc740
• messengers: sub_1400de160
• FTP clients: sub_1400de850
• browsers: sub_1400debe0

5. It packages collected material into a ZIP named from the hardware-profile GUID and uploads it in sub_14000e090.

6. It uploads screenshots in sub_1400ded60 / sub_14000e4b0.

7. It sends host profiling data in sub_14000d540 and sub_14000d980.

8. It enumerates explorer.exe processes and injects code into them in sub_140018e90.

9. In parallel, sub_140019880 loops indefinitely and terminates monitoring and analysis tools.

Key Findings

1. Hard-coded C2 / exfiltration endpoint

• String addresses in child:
• 0x140123e90 = 62.60.226.159
• 0x140123e78 = /xopbixc/data.php

• sub_14000d540 formats and POSTs host information:
• uid=%s&ver=%s&username=%s&cmpname=%s&telegram=%d

• sub_14000e090 uploads a ZIP archive using multipart/form-data to the same IP/path.

• sub_14000e4b0 uploads a screenshot using multipart/form-data with field name screen.

• sub_1400e3930 uses Winsock getaddrinfo / socket / connect against the same host and port string 27015. Why it matters: this is direct exfiltration behavior, not just a suspicious string.

2. Host profiling and victim identification

• hardware profile GUID via GetCurrentHwProfileA

• username via GetUserNameA

• computer name via GetComputerNameA

• Telegram presence via SHGetFolderPathA(..., CSIDL_APPDATA) + \Telegram Desktop\Telegram.exe Why it matters: this is characteristic reconnaissance and victim fingerprinting for a stealer.

3. Wallet and crypto-extension targeting

• \Exodus\exodus.wallet

• \Electrum\wallets

• \Bitcoin

• \atomic\Local Storage\leveldb

• Chrome / Brave / Edge extension settings for wallet extensions

• labeled targets including:
• Chrome_Metamask
• Chrome_Binance
• Chrome_Tron
• Chrome_Phantom
• Chrome_Ton
• Chrome_OKX
• Chrome_Trust
• Chrome_FRWT Why it matters: this is explicit wallet theft logic, not generic file collection.

4. Messenger and communication-app data collection

• \Telegram Desktop\tdata

• \64Gram Desktop\tdata

• \discord\Local Storage\leveldb

• \Tox\sub_1400ddab0 also creates \Messengers output and names staged Telegram-related profiles as \Profile_Tdata_.... Why it matters: this supports theft of local application data, potentially including session tokens or account artifacts.

5. Browser data collection

• \Google\Chrome\User Data\Default\Login Data

• \Microsoft\Edge\User Data\Default\Login Data

• \BraveSoftware\Brave-Browser\User Data\Default\Login Data

• corresponding Network\Cookies and Web Data paths Directly observed query logic:

• sub_140009700 executes: and writes browser-specific _History.txt output.

SELECT url, title, visit_count, last_visit_time FROM urls

• sub_14000b0e0 executes:

SELECT tab_url FROM downloads

6. FTP client targeting

7. Screenshot capture and upload

• opens the image file,

• constructs a multipart/form-data body with form field screen

• POSTs it to 62.60.226.159 /xopbixc/data.php

• deletes the local file afterward with DeleteFileW. Why it matters: this is direct visual surveillance and exfiltration.

8. Process injection into explorer.exe

• opens the target process,

• enables SeDebugPrivilege if needed,

• allocates RWX memory with VirtualAllocEx

• writes a loader stub and payload with WriteProcessMemory

• starts execution with RtlCreateUserThread. Why it matters: this is code injection for stealth, persistence of execution context, or evasion.

9. Anti-analysis / anti-monitoring behavior

• Taskmgr.exe

• SystemInformer.exe

• ProcessHacker.exe

• ProcessExplorer.exe

• procexp.exe

• procexp64.exe

• Procmon.exe

• x64dbg.exe

• OllyDbg.exe

• idaq.exe

• ida64.exe

• Wireshark.exe Why it matters: this is overt defense evasion and analyst interference.

10. Root artifact contains suspicious installer-layer strings

• http://62.60.226.159/geter/index.php?

• schtasks.exe

• /create /sc minute /tn "

• Global\%s

• Online

• clipboard API names However, I did not establish a complete reachability chain from the installer stub to those specific strings as executable behavior. They are suspicious and consistent with malware staging, but the verdict does not depend on them because the carved child already provides stronger direct evidence.

Alternative Explanations and Contrary Evidence

Strongest alternative considered

Evidence against that alternative

• The behavior-bearing child is embedded inside the installer and contains coherent, integrated theft logic rather than a benign utility feature set.

• The same child combines victim profiling, artifact collection, screenshot upload, code injection, and anti-analysis in a single control flow rooted at sub_1400191c0.

• Target lists are specific to wallets, browser extension IDs, messenger stores, and analysis tools, which does not fit ordinary installer behavior.

Contrary evidence / limits

• I did not fully reverse every carved child PE.

• The root installer contains additional suspicious strings that may represent installer-layer logic or a second-stage component, but I did not need to resolve them to reach a verdict.

• Some absence-based statements remain limited by the 98% child coverage and unresolved indirect branches.

Unknowns

• Exact installer launch chain: I established that the root contains multiple embedded PE children and that pe_013adb10.bin is malicious, but I did not fully reconstruct which embedded child the installer executes first and under what conditions.

• Full browser credential theft scope: Login Data, Cookies, and Web Data paths are present, and browser history/download collection is directly implemented. I did not fully recover all SQL queries or decryption paths needed to prove password or cookie exfiltration with the same certainty.

• Clipboard replacement behavior: the sample contains clipboard API names in strings, but I did not isolate the code path that uses them. This remains suspicious rather than confirmed.

• Scheduled-task persistence from root strings: schtasks.exe and /create /sc minute /tn are present in the root artifact, but I did not attribute them to a confirmed executable path. These unknowns do not materially change the verdict because the confirmed malicious behaviors are already sufficient.

Indicators

File indicators

• Root SHA256: 1cbb2f40b21153e4c6f978fa119671fc97657ac0f3c48b7121fc5ec865053cb0

• Malicious child SHA256: b14da601f75e6626a5f22b0559809aae64becaac46deb392bb9f3e19e91624e1

• Carved offset of malicious child within root: 0x13adb10

Network indicators

• IP: 62.60.226.159

• HTTP path: /xopbixc/data.php

• Additional probed port: 27015

• User-Agent seen in code:
• Mozilla/5.0
• Mozilla/5.0 (Windows NT 10.0; Win64; x64)

Host indicators

• Mutex: build_cvbfihjudpnetx

• Process injection target: explorer.exe

• Anti-analysis kill list includes Taskmgr.exe, SystemInformer.exe, ProcessHacker.exe, ProcessExplorer.exe, procexp64.exe, Procmon.exe, x64dbg.exe, OllyDbg.exe, idaq.exe, ida64.exe, Wireshark.exe

• Staging/output names include Screenshot.jpg, \Wallets, \Messengers, \FTP Clients, \Browsers

Verdict Rationale