New Steganographic Malware Hides in JPG Files to Deploy Multiple Password Stealers

A recent cybersecurity threat has emerged in the form of a steganographic campaign that uses seemingly harmless JPG files to distribute multiple types of malware, including password stealers like Remcos and AsyncRAT.

This sophisticated attack begins with a phishing email containing a malicious Excel document that exploits a known vulnerability, CVE-2017-0199, to initiate the infection chain.

Infection Chain and Malware Deployment

The Excel document, upon opening, issues an HTTP request to download a .hta file containing VBScript code.

This script writes a batch file that connects to a paste URL to download another obfuscated VBScript.

The VBScript then downloads a JPG file, which appears harmless but contains a base64 encoded malicious loader.

According to the Seqrite Blog Report, this loader is decoded and executed, leading to the deployment of the final payload.

The JPG file’s use of steganography allows it to conceal the malware effectively, making detection challenging.

In the case of Remcos and AsyncRAT, both are remote access Trojans (RATs) with capabilities that include command and control communication, keystroke logging, and additional payload execution.

Remcos, in particular, has been a persistent threat since its inception in 2016, known for its robust command and control features.

AsyncRAT, written in C#, offers similar functionalities with the added capability of evading detection through techniques like delayed execution.

Technical Details and Evasion Techniques

The malware uses process hollowing to inject malicious code into legitimate processes, ensuring persistence and evasion from security software.

The DLLs involved are obfuscated, with some common .NET function names obscured, making reverse engineering more difficult.

The attack also employs masquerading techniques, where malicious scripts are disguised as genuine system files or scripts, such as “prnmngr.vbs,” which is used to manage printers, thereby avoiding suspicion.

The command and control servers for these malware variants have the capability to deploy additional payloads, further compromising the victim’s system.

The use of steganography in JPG files highlights the evolving nature of cyber threats and the need for robust cybersecurity measures to protect against such sophisticated attacks.

Users are advised to remain vigilant and adopt best practices to safeguard their systems and data integrity.

Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.

Keep your files stored safely and securely with the SanDisk 2TB Extreme Portable SSD. With over 69,505 ratings and an impressive 4.6 out of 5 stars, this product has been purchased over 8K+ times in the past month. At only $129.99, this Amazon’s Choice product is a must-have for secure file storage.

Help keep private content private with the included password protection featuring 256-bit AES hardware encryption. Order now for just $129.99 on Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!