What is Indeanapolice.cc? Malware Analysis and Removal Guide

Background

The sample is a small (~4 KB) PowerShell script (SHA-256 a803ed59…b61) classified as suspicious (risk 62/100) by automated triage. Read in isolation it is just an obfuscated one-liner, but its behaviour, an execution-policy bypass, an Invoke-WebRequest download piped into IEX, and in-memory execution, is a textbook download cradle, and triage associates it with the indeanapolice[.]cc dropper campaign.

indeanapolice[.]cc is a real, recently-registered malicious domain with a bottom-of-the-barrel reputation (trust score 1/100). In documented activity the chain begins with a Setup.exe dropper that launches PowerShell with an execution-policy bypass to download and run a remote payload (for example, a file disguised as OST_Walker.pdf) from indeanapolice[.]cc, whose C2 resolves to 94.183.233.21. The delivered payload is an information-stealer.

What we observed

What the sample and the wider campaign actually do:

• A download cradle, not a self-contained payload: the script is a heavily obfuscated PowerShell one-liner using randomized variable names (e.g. $nilrg, $kmsep, $mclst, $kcmn) and an Invoke-WebRequest call piped to IEX, so the real malware is fetched and executed in memory, leaving little on disk.
• The delivery chain: a Setup.exe dropper invokes PowerShell with an execution-policy bypass to pull the next stage from indeanapolice[.]cc (payload URL observed as https://indeanapolice[.]cc/OST_Walker.pdf), with command-and-control resolving to 94.183.233.21.
• The objective is theft: the delivered stealer targets Chrome extension data and IndexedDB stores for saved browser passwords and credentials, searches the disk for cryptocurrency wallet files, and performs registry operations via WMI. Some variants carry additional keylogging or ransomware behaviour.
• Evasion by design: the sample performs WMI VM fingerprinting (querying system model and manufacturer) and uses extended sleeps to outlast sandbox time limits, while the fileless IEX execution minimises disk artefacts.
• Triage hygiene, correct before you act: the automated run returned 0 ATT&CK mappings (an engine gap; the techniques below are analyst-derived from the observed behaviour), and it listed the legitimate Microsoft authentication CDN aadcdn.msftauth.net as an ‘IOC’. That is a false positive, blocking it would break Microsoft sign-in. Several ‘signature matches’ (SAM access, IAT hooking, email collection) are also implausible for a 4 KB script and should be verified, not published as fact.

indeanapolice.cc dropper chain

The malware is never fully on disk: PowerShell downloads and runs it in memory, so behavioural and script-block logging beats file signatures here.

Attribution

This is commodity, financially motivated cybercrime rather than a named nation-state actor, an information-stealer distributed through a disposable dropper domain. The very recent registration and 1/100 reputation of indeanapolice[.]cc are consistent with a short-lived, rotate-and-repeat campaign, so expect the domain and IP to change while the PowerShell-cradle technique stays the same. The binding of this specific sample to the campaign comes from triage association and shared tradecraft; the campaign’s malicious nature and infrastructure are independently corroborated.

Confidence: 75%.

A 4 KB PowerShell one-liner is all it takes: bypass the policy, download in memory, and walk off with every saved password and wallet.

Tactics, techniques & procedures (MITRE ATT&CK)

Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:

Indicators of compromise

Defenders can block or hunt the following:

Detection

Copy-ready hunting query:

# Hunt for the indeanapolice.cc PowerShell cradle and stealer chain
# 1) PowerShell download cradles with execution-policy bypass
index=edr process_name="powershell.exe" (command_line="*-ep bypass*" OR command_line="*-ExecutionPolicy Bypass*") (command_line="*Invoke-WebRequest*" OR command_line="*DownloadString*" OR command_line="*DownloadData*" OR command_line="*IEX*" OR command_line="*Invoke-Expression*")
# 2) Setup.exe (or other parents) spawning PowerShell that reaches out to the web
index=edr parent_process="setup.exe" process_name="powershell.exe"
# 3) C2 / payload indicators
index=dns OR index=proxy (domain="indeanapolice.cc" OR dest_ip="94.183.233.21" OR url="*indeanapolice.cc/OST_Walker.pdf*")
# 4) Post-exploitation: access to browser credential stores and wallet files
index=edr (file_path="*\\User Data\\*\\IndexedDB\\*" OR file_path="*\\Local Extension Settings\\*" OR file_path="*wallet*" OR file_path="*\\Ethereum\\*" OR file_path="*\\Exodus\\*")

# NOT indicators -- do NOT block (triage false positives):
#   aadcdn.msftauth.net   (legitimate Microsoft authentication CDN)
#   bucherer.com          (legitimate retailer; weak/unverified association)
# Enable PowerShell script-block + module logging and AMSI to capture the deobfuscated cradle.

Recommendations

• Block the real indicators: indeanapolice[.]cc, 94.183.233.21, the payload URL, and the file hashes, but do NOT block aadcdn.msftauth.net (legitimate Microsoft CDN) or bucherer.com (legitimate retailer); both are triage false positives.
• Hunt the technique, not just the domain: alert on PowerShell launched with -ExecutionPolicy Bypass that also calls Invoke-WebRequest/DownloadString/DownloadData or IEX, and enable script-block + module logging, AMSI, and Constrained Language Mode to catch the deobfuscated cradle.
• Assume credential and wallet theft on execution: reset passwords for browser-saved accounts, revoke active sessions and tokens, and move cryptocurrency wallets and seed phrases to a clean device. The stealer targets exactly these.
• Correct the automated triage before publishing or actioning it: the run returned 0 ATT&CK mappings (the real techniques are PowerShell / T1105 / T1027 / T1497), flagged a Microsoft CDN as malicious, and produced implausible signatures for a 4 KB script, verify anything high-impact.
• Reduce the attack surface: restrict PowerShell (application control / allowlisting), block or monitor script execution from network shares (this sample was staged from an internal \\ShareSpace\Scripts path), and treat newly-registered, low-reputation domains as higher risk at the proxy.