Procedure examples

PowerDuke uses steganography to hide backdoors in PNG files, which are also encrypted using the Tiny Encryption Algorithm (TEA).

Pikabot loads a set of PNG images stored in the malware's resources section (RCDATA), each with an encrypted section containing portions of the core Pikabot core module. These sections are loaded and decrypted using a bitwise XOR operation with a hardcoded 32 bit key.

Avenger can extract backdoor malware from downloaded images.

PolyglotDuke can use steganography to hide C2 information in images.

RegDuke can hide data in images, including use of the Least Significant Bit (LSB).

ProLock can use .jpg and .bmp files to store its payload.

RDAT can also embed data within a BMP image prior to exfiltration.

Okrum's payload is encrypted and embedded within its loader, or within a legitimate PNG file.

Diavol has obfuscated its main code routines within bitmap images as part of its anti-analysis techniques.

Raindrop used steganography to locate the start of its encoded payload within legitimate 7-Zip code.

IcedID has embedded binaries within RC4 encrypted .png files.

ObliqueRAT can hide its payload in BMP images hosted on compromised websites.

Bandook has used .PNG images within a zip file to build the executable.

LiteDuke has used image files to hide its loader component.

ABK can extract a malicious Portable Executable (PE) from a photo.

Ramsay has PE data embedded within JPEG files contained within Word documents.

build_downer can extract malware from a downloaded JPEG.

BBK can extract a malicious Portable Executable (PE) from a photo.

Invoke-PSImage can be used to embed a PowerShell script within the pixels of a PNG file.