Date: 11/04/2026
Severity: High
Summary
Researchers uncovered a fake-download campaign distributing trojanized installers disguised as legitimate games, cracked software, and utilities to compromise Windows systems. The campaign deploys unwanted monetization payloads, including proxyware, distributed-computing applications, and system utilities, to exploit victims' computing resources and network bandwidth for financial gain. The infection chain uses installer-based execution and multiple bundled payloads, enabling deceptive software installation, resource hijacking, and unauthorized monetization. The activity highlights the risks associated with malvertising, fake software downloads, trojanized installers, and potentially unwanted applications.
Indicators of Compromise (IOC) List
Domains/URLs | beliefdesk.xyz companyharbor.xyz signalpane.cfd inkact.xyz wishgrove.cfd |
Hash | 006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c
21306fc5716f95e252388f920314b42f1c8bcc7df67cb4d39da30217b96f4044
72750d32b440e9f2b6d05ff3d218a561a75d3d75fb976b461fa59897674a7f70
ab2c2dd37fdcfe1e7620a57f98c80bd063258bea145adc0cc6a0f8b1e24c6a8f
452a210bba4c8d08f7cb7733a816d7220a7fa570a469aea0a997cfc8b594b6a0
523fb81fae0c7beba7b5171243cc0dee7a4d04ae0483be9172eef2394a5a2152
55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f
|
File Paths | %TEMP%\is-*.tmp\eld*.exe C:\Program Files\WorldProxyPool\sdk-agent.exe |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "inkact.xyz" or url like "inkact.xyz" or siteurl like "inkact.xyz" or domainname like "beliefdesk.xyz" or url like "beliefdesk.xyz" or siteurl like "beliefdesk.xyz" or domainname like "signalpane.cfd" or url like "signalpane.cfd" or siteurl like "signalpane.cfd" or domainname like "companyharbor.xyz" or url like "companyharbor.xyz" or siteurl like "companyharbor.xyz" or domainname like "wishgrove.cfd" or url like "wishgrove.cfd" or siteurl like "wishgrove.cfd" |
Detection Query 2 : | sha256hash IN ("772750d32b440e9f2b6d05ff3d218a561a75d3d75fb976b461fa59897674a7f70","452a210bba4c8d08f7cb7733a816d7220a7fa570a469aea0a997cfc8b594b6a0","006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c","ab2c2dd37fdcfe1e7620a57f98c80bd063258bea145adc0cc6a0f8b1e24c6a8f","55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f","523fb81fae0c7beba7b5171243cc0dee7a4d04ae0483be9172eef2394a5a2152","21306fc5716f95e252388f920314b42f1c8bcc7df67cb4d39da30217b96f4044")
|
Detection Query 3 : | datasourcename = "Windows Security" and eventtype = "4663" and (objectname like "%TEMP%\is-%.tmp\eld%.exe" OR objectname like "C:\Program Files\WorldProxyPool\sdk-agent.exe") |
Detection Query 4 : | technologygroup = "EDR" and (objectname like "%TEMP%\is-%.tmp\eld%.exe" OR objectname like "C:\Program Files\WorldProxyPool\sdk-agent.exe") |
Reference:
Trojanized Installers Enable Unauthorized Resource Hijacking