> Concept · Bitmap Steganography Payload Delivery_

~/packetpursuit $ cat /intel/concepts/bitmap-steganography-payload-delivery.md

typeconceptconfidencehighcreated2026-07-08updated2026-07-08dotnetobfuscationloaderbitmap-steganographydefense-evasionpayload

Bitmap Steganography Payload Delivery

Description

A .NET malware payload-staging pattern where the encrypted or compressed payload is hidden inside embedded bitmap (BMP) image resources. The outer PE carries 8–24 small BMP files (typically 76×76×24 or 88×88×24) inside its .rsrc section. At runtime, the loader uses System.Drawing.Bitmap to load each bitmap, extracts pixel data or appended ciphertext, decrypts it via AES/Rijndael, and reconstructs the inner payload into a .NET assembly for reflective execution.

Why It Is Used

  • Evasion: BMP files in .rsrc are commonplace for .NET applications and rarely flagged by static scanners
  • Layering: Each bitmap contains a slice of the payload; reconstruction requires knowing the extraction order and decryption key
  • Anti-static: Without the decryption routine, the payload is irrecoverable from the PE alone

Static Indicators

  • System.Drawing.Bitmap strings paired with System.Resources.ResourceReader / RuntimeResourceSet ^[sample a497a066/strings.txt]
  • System.Drawing.Imaging namespace references (pixel lock / scanline access)
  • Binwalk detects multiple PC bitmap, Windows 3.x format structures inside .rsrc
  • Bitmap dimensions are typically small and uniform (e.g., 21 bitmaps at 76×76×24)
  • CreateDecryptor / RijndaelManaged / SHA256 in strings

Extraction Pattern

  1. ResourceManager.GetObject("resource_name") returns System.Drawing.Bitmap
  2. Bitmap.LockBits accesses raw pixel bytes (or reads appended data after BMP header)
  3. Pixel bytes are concatenated across all bitmaps in a fixed order
  4. AES/Rijndael decryption (often with SHA256-derived key) yields a .NET assembly byte[]
  5. Assembly.Load(byte[]) → MethodBase.Invoke executes the inner payload

Variants

Build Bitmap Count Dimensions Notes
4bf14434 (progenitor) ~20 76×76×24 First observed; SoapHttpClientProtocol
f6b5bdd5 (Feb 2020) ~20 76×76×24 Spanish payment lure; BackgroundWorker staging
f74d8a51 (Mar 2023) ~24 76×76×24 Largest sibling; OBD2/service GUI masquerade
f230118d (May 2026) 16 88×88×24 Added DeflateStream / System.IO.Compression
d4d106f8 (Jun 2026) 8 136×136×24 Bitmaps in .text; dropped SOAP
a497a066 (Feb 2020) 21 76×76×24 Maritime lure; simplest AES-only chain

Contrast with Image-Steganography (Plaintext Marker)

The image-steganography-payload-delivery concept covers JPG/text carriers with <<START>>/<<END>> plaintext markers and Base64 payloads. Bitmap-steganography uses binary BMP structures with no plaintext markers; extraction requires the .NET runtime and the decryption key.

Detection

  • Host: Monitor System.Drawing.Bitmap loads followed by Assembly.Load within the same process
  • Static: Binwalk scan for >5 PC bitmap structures inside a .NET PE .rsrc
  • Network: Post-extraction network activity from the inner assembly (often SOAP HTTP or System.Net.Sockets TCP)

Related