EN PT-BR
← Voltar ao feed
medium

Fake Software/Game Installers Deploy Multi-Stage PUA Payloads on Windows via Inno Setup Wrappers

1 fonte(s) · 1 atualização(ões) · publicado 04/11/2026 02:56 · coletado há 1 hora

Microsoft published research on November 3, 2026 detailing an evolving fake-download campaign that trojanizes installers disguised as popular games, cracked software, and utilities to monetize Windows PCs. Rather than dropping a single payload, the operation chains multiple unwanted software "offers" within one installation session, converting victim bandwidth and compute resources into revenue through proxyware, distributed-computing enrollment, and bundled utility installs. Microsoft identified three confirmed branches: WorldProxyPool proxyware, CharityEngine/BOINC distributed-computing software, and Advanced Windows Manager utilities. Lures observed include Echo Client, FabFilter Total Bundle, Navicat Premium cracks, Deadpool Apunka Games, Command & Conquer: Red Alert 2, and TFT Unlock Tool, targeting users seeking software cracks, audio plugins, game downloads, Roblox executors, auto-clickers, and mobile-unlock tools.

Detalhes técnicos

Execution begins with an Inno Setup-style wrapper that creates a temporary runner beneath %TEMP%\is-*.tmp\, launching numbered executables (eld0.exe, eld3.exe, eld4.exe) using arguments like /SL5, /SPAWNWND, and /FIRSTWND. Temporary runners beacon to rotating domains with HTTP requests containing d=inno and r=offer_execution, using session, affiliate, offer, download-network, and placement parameters to coordinate delivery and track outcomes; failed attempts log r=offer_execution_fail. Each offer operates independently, so blocking one payload does not stop others. WorldProxyPool installs under C:\Program Files\WorldProxyPool\ and creates three SYSTEM-level scheduled tasks (boot-time agent start, a five-minute PowerShell watchdog, and an hourly updater). The CharityEngine/BOINC branch installs boinc.exe, charityengine.exe, compute wrappers, and VirtualBox, enrolling machines into distributed-computing infrastructure (not confirmed cryptomining). The utility branch deploys AdvancedWindowsManager.exe and Windows Updater.exe via an MSI package, using silent switches (/qn, /S, /quiet, /norestart) to minimize visibility.

Remediação

Microsoft recommends prohibiting untrusted software sources, investigating unexpected installations, and auditing scheduled tasks tied to these components. Organizations should inventory software for WorldProxyPool, CharityEngine, BOINC, VirtualBox, and AW Manager, distinguishing legitimate deployments from bundled ones. Enabling potentially unwanted application (PUA) protection in Microsoft Defender, along with real-time and behavior monitoring, is advised, deployable via Intune, Group Policy, or PowerShell. Because infrastructure rotates frequently, behavioral detection and correlation of callback parameters with staged filenames and process activity are more effective than domain-based blocking alone.

Linha do tempo

  1. gbhackers.com ↗ · pub. 04/11/2026 02:56 · coletado 04/11 03:00 primeiro registro

    Fake Software/Game Installers Deploy Multi-Stage PUA Payloads on Windows via Inno Setup Wrappers

    ler a análise desta fonte

    Microsoft published research on November 3, 2026 detailing an evolving fake-download campaign that trojanizes installers disguised as popular games, cracked software, and utilities to monetize Windows PCs. Rather than dropping a single payload, the operation chains multiple unwanted software "offers" within one installation session, converting victim bandwidth and compute resources into revenue through proxyware, distributed-computing enrollment, and bundled utility installs. Microsoft identified three confirmed branches: WorldProxyPool proxyware, CharityEngine/BOINC distributed-computing software, and Advanced Windows Manager utilities. Lures observed include Echo Client, FabFilter Total Bundle, Navicat Premium cracks, Deadpool Apunka Games, Command & Conquer: Red Alert 2, and TFT Unlock Tool, targeting users seeking software cracks, audio plugins, game downloads, Roblox executors, auto-clickers, and mobile-unlock tools.

    Technical Details

    Execution begins with an Inno Setup-style wrapper that creates a temporary runner beneath %TEMP%\is-*.tmp\, launching numbered executables (eld0.exe, eld3.exe, eld4.exe) using arguments like /SL5, /SPAWNWND, and /FIRSTWND. Temporary runners beacon to rotating domains with HTTP requests containing d=inno and r=offer_execution, using session, affiliate, offer, download-network, and placement parameters to coordinate delivery and track outcomes; failed attempts log r=offer_execution_fail. Each offer operates independently, so blocking one payload does not stop others. WorldProxyPool installs under C:\Program Files\WorldProxyPool\ and creates three SYSTEM-level scheduled tasks (boot-time agent start, a five-minute PowerShell watchdog, and an hourly updater). The CharityEngine/BOINC branch installs boinc.exe, charityengine.exe, compute wrappers, and VirtualBox, enrolling machines into distributed-computing infrastructure (not confirmed cryptomining). The utility branch deploys AdvancedWindowsManager.exe and Windows Updater.exe via an MSI package, using silent switches (/qn, /S, /quiet, /norestart) to minimize visibility.

    Remediation

    Microsoft recommends prohibiting untrusted software sources, investigating unexpected installations, and auditing scheduled tasks tied to these components. Organizations should inventory software for WorldProxyPool, CharityEngine, BOINC, VirtualBox, and AW Manager, distinguishing legitimate deployments from bundled ones. Enabling potentially unwanted application (PUA) protection in Microsoft Defender, along with real-time and behavior monitoring, is advised, deployable via Intune, Group Policy, or PowerShell. Because infrastructure rotates frequently, behavioral detection and correlation of callback parameters with staged filenames and process activity are more effective than domain-based blocking alone.