Cracking CastleLoader’s Inno Setup Password

I came across CastleLoader malware (sha256: 8b7c1657f4d5cf0cc82d68c1f1a385adf0de27d46fc544bba249698e6b427856) recently. Looking into it, I saw it uses Inno Setup to package its files. Normally, to get those dropped files, you would run the sample and grab them from the file system.

But if you are like me and prefer static analysis, running it is not the only way. You can crack the password used to encrypt the Inno Setup files. Here is how I did it.

👇 Full walkthrough on my blog: