Proxying execution via callback param passed to EnumUILanguagesA.

Translate “IPs” to binary to reveal shellcode.

The binary representation of all of these IPs is combined to form a blob of shellcode. Each one of these IPs is passed to the RtlIpv4StringToAddressA function, which will translate the ASCII IP string to binary.

The obfuscated payload masquerades itself as an array of ASCII IPv4 addresses. The samples in question are 64-bit Windows Portable Executables, each containing an obfuscated payload used to deliver an additional implant. Along with the IPfuscation technique, we have identified a number of markers which have allowed us to pivot into additional discoveries around the actor or group behind this campaign. In this post, we describe this novel technique as it is used across several variants of malware. The sample at the end of this chain is not necessarily sophisticated or particularly novel, but it does leverage an interesting obfuscation technique that we have dubbed “IPfuscation”. In a recent IR engagement, our team happened upon a rather interesting packer ( aka crypter or obfuscator) that was ultimately utilized to construct and execute shellcode responsible for downloading a Cobalt Strike Beacon.

By James Haughom, Antonis Terefos, Jim Walter, Jeff Cavanaugh, Nick Fox, and Shai Tilias Overview

The hive ip