Malware

in2al5d p3in4er

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

These fake websites use similar URLs, logos, and branding to convincingly appear legitimate. Once a user visits one of these sites, they’re enticed to download an application containing malware or lured to enter sensitive/personal information into the decoy generated website.

T1566PhishingEvidence1

One growing trend is using YouTube as a malware distribution channel. Hackers take over popular YouTube accounts and post videos with links to malicious websites or downloads.

Execution

1 technique

T1106Native APIEvidence1

This loader uses a surprisingly simple yet highly effective evasion technique. It leverages the usage of CreateDXGIFactory function of dxgi.dll library... During the injection process, all loader samples resolve the necessary Win APIs dynamically

Privilege Escalation

1 technique

T1055.012Process HollowingEvidence1

After checking the vendor IDs, the loader decrypts the final payload in separate chunks and injects it into `sihost.exe` using a process hollowing technique.

Stealth

6 techniques

T1027.007Dynamic API ResolutionEvidence1

During the injection process, all loader samples resolve the necessary Win APIs dynamically and decrypt these names using a XOR key: “ in2al5d p3in4er ” (invalid printer)

T1036MasqueradingEvidence1

The service the threat actors are using enables the creation of decoy websites that look identical to the original websites. These fake websites use similar URLs, logos, and branding to convincingly appear legitimate.

T1055.012Process HollowingEvidence1

After checking the vendor IDs, the loader decrypts the final payload in separate chunks and injects it into `sihost.exe` using a process hollowing technique.

T1140Deobfuscate/Decode Files or InformationEvidence1

After checking the vendor IDs, the loader decrypts the final payload in separate chunks... During the injection process, all loader samples resolve the necessary Win APIs dynamically and decrypt these names using a XOR key

T1497Virtualization/Sandbox EvasionEvidence1

It leverages the usage of CreateDXGIFactory function of dxgi.dll library to query the vendor ID of the graphics card installed on a system. The ID is then compared against a whitelist of vendor IDs; specifically, the 0x10de (NVIDIA), 0x1002 (AMD), and 0x8086 (Intel) graphics cards. If the vendor ID doesn’t match the whitelisted values, the loader makes it appear as a benign application by terminating itself.

T1497.001System ChecksEvidence1

The anti-VM function checks the graphics vendor ID... If the vendor ID doesn’t match the whitelisted values, the loader makes it appear as a benign application by terminating itself.

Discovery

2 techniques

T1497Virtualization/Sandbox EvasionEvidence1

T1497.001System ChecksEvidence1

The anti-VM function checks the graphics vendor ID... If the vendor ID doesn’t match the whitelisted values, the loader makes it appear as a benign application by terminating itself.

INDICATORS OF COMPROMISE

IOCs tracked for this family

41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

14 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

27 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

hash.sha256●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

morphisecNews

Apr 21, 2025

in2al5d p3in4er is Almost Completely Undetectable

A highly evasive first-stage loader used to deliver Aurora. It checks GPU vendor IDs via CreateDXGIFactory/dxgi.dll as an anti-VM technique, decrypts payloads in chunks, dynamically resolves WinAPI names using an XOR key, and injects or executes the decrypted payload via process hollowing into sihost.exe or direct memory execution.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching41

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

in2al5d p3in4er

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

T1566PhishingEvidence1

One growing trend is using YouTube as a malware distribution channel. Hackers take over popular YouTube accounts and post videos with links to malicious websites or downloads.

Execution

1 technique

T1106Native APIEvidence1

Privilege Escalation

1 technique

T1055.012Process HollowingEvidence1

After checking the vendor IDs, the loader decrypts the final payload in separate chunks and injects it into `sihost.exe` using a process hollowing technique.

Stealth

6 techniques

T1027.007Dynamic API ResolutionEvidence1

During the injection process, all loader samples resolve the necessary Win APIs dynamically and decrypt these names using a XOR key: “ in2al5d p3in4er ” (invalid printer)

T1036MasqueradingEvidence1

T1055.012Process HollowingEvidence1

After checking the vendor IDs, the loader decrypts the final payload in separate chunks and injects it into `sihost.exe` using a process hollowing technique.

T1140Deobfuscate/Decode Files or InformationEvidence1

T1497Virtualization/Sandbox EvasionEvidence1

T1497.001System ChecksEvidence1

The anti-VM function checks the graphics vendor ID... If the vendor ID doesn’t match the whitelisted values, the loader makes it appear as a benign application by terminating itself.

Discovery

2 techniques

T1497Virtualization/Sandbox EvasionEvidence1

T1497.001System ChecksEvidence1

The anti-VM function checks the graphics vendor ID... If the vendor ID doesn’t match the whitelisted values, the loader makes it appear as a benign application by terminating itself.

INDICATORS OF COMPROMISE

IOCs tracked for this family

41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

14 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

27 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

hash.sha256●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

morphisecNews

Apr 21, 2025

in2al5d p3in4er is Almost Completely Undetectable

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching41

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.