Bin2IP

A utility for translating a raw shellcode file into IPv4 or IPv6 addresses.

This script is based on Will Summerhill's IPv4Fuscation-Encrypted generation script. You can find the script here.

The source code generated by this script is based in part on the Orca000 HellShell project.

Background

The Hive ransomware group was first observed storing shellcode as IP addresses in March of 2022. You can read SentinelOne's analysis of the technique here.

References

The Art of Obfuscation - Evading Static Malware Detection Link to Red Siege blog