InnoSetup (Trojan) – Malware

Overview

The recent discovery of a sophisticated new malware variant utilizing the InnoSetup installer framework has raised significant concerns in the cybersecurity community. This malware, identified by AhnLab Security Intelligence Center (ASEC) and referred to as “InnoLoader,” represents a notable evolution in how threat actors distribute and execute malicious software. Unlike conventional malware, which typically launches its payload immediately upon execution, InnoLoader cunningly masquerades as legitimate software, displaying a familiar installation interface. The true danger lies beneath the surface, as the malware’s harmful activities are triggered only when users interact with the installation process by clicking specific buttons.

What sets InnoLoader apart is its innovative distribution mechanism. Rather than relying on pre-made malware samples, the malware dynamically creates a unique instance each time a user initiates a download. This means that every download produces a version of the malware with a different hash value but identical functionality, significantly complicating efforts to track and block it. By generating a fresh sample for each download attempt, the threat actors behind InnoLoader are effectively evading traditional detection methods, making it increasingly difficult for security teams to respond swiftly and effectively to its spread.

Targets

Individuals.

How they operate

Upon execution, the malware displays a typical installation interface, luring the user into believing that they are installing legitimate software. The malicious behaviors are triggered only when the user interacts with the installer by clicking through the prompts. The malware connects to a command and control (C2) server, where it sends information about the system and receives commands that dictate its next steps. Depending on the C2 response, the malware can download and execute various payloads, including infostealers, proxy tools, and clickers disguised as security plugins.

A key aspect of the malware’s operation is its ability to dynamically alter its behavior based on the C2 server’s instructions. For example, if the C2 server responds with an “ok” message, the malware proceeds to download and execute additional files from URLs provided by the server. These files can range from harmless applications, like the Opera browser, to highly malicious payloads, such as the StealC infostealer, which harvests sensitive information like passwords, cryptocurrency wallet credentials, and FTP login details.

The malware is also designed to hinder analysis and detection. In cases where the C2 server returns a “no” response, the installation process terminates without executing any malicious actions, making it difficult for researchers to capture and study the malware in controlled environments. Additionally, the malware’s use of unique download URLs and hash values for each instance further complicates forensic analysis. This complex and adaptive behavior, combined with its use of the InnoSetup framework, makes this malware a formidable threat that requires vigilant cybersecurity measures to detect and mitigate.

MITRE Tactics and Techniques

Execution

T1059.001 – Command and Scripting Interpreter: PowerShell

InnoLoader executes scripts, such as a malicious BAT file, using the msiexec command. This file subsequently downloads and runs other malicious components.

Defense Evasion

T1027 – Obfuscated Files or Information

The malware uses obfuscation techniques in its scripts and downloaded components to evade detection and analysis. It may also download legitimate software to disguise its malicious activities.

Persistence

T1547.001 – Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

To maintain persistence, InnoLoader can copy itself to the ProgramData directory and create a shortcut in the Startup folder, ensuring it runs every time the system starts.

Command and Control

T1071.001 – Application Layer Protocol: Web Protocols

InnoLoader communicates with a C2 server using web protocols. The server’s response determines the malware’s behavior, such as whether to download additional malicious components.

Collection

T1119 – Automated Collection

The malware can collect sensitive information, such as passwords and application login data, which is then exfiltrated to the C2 server.

Exfiltration

T1041 – Exfiltration Over C2 Channel

Exfiltrated data, including stolen credentials and other sensitive information, is sent back to the C2 server via established communication channels.

Discovery

T1082 – System Information Discovery

InnoLoader performs system reconnaissance to gather information about the infected system, which is then sent to the C2 server to inform further actions.

References:

• New InnoSetup Malware Created Upon Each Download Attempt