IPfuscation

0001-01-01

IPfuscation is an anti-analysis obfuscation technique where data is converted to and from IP addresses to obfuscate its true content.

An IPv4 address contains 4 octets. Each octet of an IPv4 address represents one byte of data. Converting an IP address such as 4.4.4.4 is equivalent to four bytes of data: \x04\x04\x04\x04.

A WinAPI function RtlIpv4StringToAddressA converts IPv4 addresses to a DWORD. Chaining several bogus IP addresses together in this manner can be used to encode shellcode in a manner that appears to be a bunch of IP addresses.

IPv6 addresses can be used in a similar manner to hold 16 bytes of data with the RtlIPv6StringToAddressA WinAPI function.

This technique was observed in use by the Hive Ransomware malware

https://www.sentinelone.com/blog/hive-ransomware-deploys-novel-ipfuscation-technique/


Links to this note