image-steganography-payload-delivery

Malware technique: hide executable payloads inside seemingly benign image files (JPG, PNG, BMP) or text files using plaintext markers. The carrier file is hosted on free or legitimate services (Bitbucket, paste sites, image hosts) and downloaded by the dropper. The payload is extracted by searching for start/end markers and base64-decoding the content between them.

Pattern Definition

1. Attacker encodes a payload (typically a .NET assembly, shellcode, or PowerShell script) as Base64.
2. The Base64 string is wrapped in markers (e.g., <<START>> and <<END>>).
3. The wrapped payload is embedded inside a carrier file — either appended to a JPG binary or placed inside a text file.
4. The dropper downloads the carrier, searches for the markers, extracts the payload, decodes it, and executes reflectively.

Variants

• Image carrier: Payload appended to the end of a JPG file; the JPG remains viewable because the marker and payload sit after the End of Image (EOI) marker (FF D9).
• Text carrier: Plaintext hosting (pastebin, GitHub Gist, Bitbucket raw) where the carrier is a text file with the markers and payload inline.

Cross-References

• unclassified-js-bitbucket-stego-dropper — JScript dropper using Bitbucket JPG + paste.sensio.no text carriers
• poem-word-list-steganography — Conceptually related: hiding payloads in natural-language prose using lookup tables

Defensive Detection

• Network: monitor downloads of .jpg files from Bitbucket/GitHub repositories with suspicious names (e.g., ghkjkghlkgl/ghf)
• Host: PowerShell processes reading .jpg files into memory and performing IndexOf searches for <<START>> or similar markers
• Host: System.Reflection.Assembly::Load called immediately after a network download of an image file