How an Analyst Retrieved a Malicious Advanced IP Scanner Installer
Summary
A Huntress analyst traced a malicious Advanced IP Scanner download served through a lookalike site, retrieved the executable from an exposed directory, decoded its Base64 contents, and matched its SHA-256 hash to the alert.
Key points
- The lookalike site advanced[.]ip-scanner[.]co redirected visitors to the legitimate site unless the request appeared to come from a Google ad.
- The analyst used Postman to send a GET request with a Google Referer header and inspected the returned HTML for download links.
- The /download directory was accessible even without the Referer header; ipscanner.txt contained Base64-encoded executable data.
- The analyst decoded the file with CyberChef and with certutil, then confirmed its SHA-256 hash matched the file hash from the original alert.
- The apps2co.php link also served the executable, but the article did not analyze the malware’s behavior or report what it did after execution.
Article Details
- Topic
- Malicious Advanced IP Scanner distribution through Google Ads and analysis of the download site
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//advanced[.]ip-scanner[.]co | Site identified as malicious and used to present a fake Advanced IP Scanner download. |
People
Products
Tools
certutilI’m going to download the raw Base64 on to my VM (virtual machine) as a .txt file and use certutil to decode it using the command certutil -decode source dest.CyberChefOff to CyberChef! For anyone who’s unfamiliar, CyberChef is a fantastic web-based tool for data analysis.PostmanOkay let’s head over to Postman and give it a shot.