TerminalFix: PNG Steganography, (Mon, Sep 21st)

Reporting by SANS Internet Storm CenterRead the original at isc.sans.edu

Executive Summary

Threat actors utilized PNG files to conceal data through steganography in a reverse tunnel intrusion campaign documented by Microsoft Security Research. The investigation involved an image file, f5f1eb6d43dd61d5b069c250e5c666384f7417d0c95014773bf9edf8ff13bebe, suspected of containing a payload. Analysis with pngdump.py confirmed the file structure was valid PNG format, containing expected chunks (IHDR, IDAT, IEND). Examination of the decompressed pixel data revealed encoded information resembling strings from a Windows executable, indicating the presence of a hidden Portable Executable (PE) file within the image pixels. The embedded PE file was identified as LockScreenContentServer.exe, which is used for sideloading. Two other PNG files were also analyzed and found to contain parts of a malicious DLL, leading to the reconstruction of the full payload.

Facts Only

* Threat actors deployed a reverse tunnel through multistage intrusion.
* PNG files with steganography were used in the campaign.
* The first image file was f5f1eb6d43dd61d5b069c250e5c666384f7417d0c95014773bf9edf8ff13bebe.
* Analysis of the PNG confirmed valid header and IDAT chunks.
* Decompressed pixel data contained strings consistent with a Windows executable (PE file).
* The first 8 bytes of the raw bitmap indicated the length of an embedded PE file, calculated as 49720.
* The embedded file was identified as LockScreenContentServer.exe.
* Two additional PNG files contained parts of a malicious DLL payload.
* The payload was reconstructed by concatenating the parts from the two secondary files.

Full Take

The methodology observed indicates a deliberate choice to maximize data concealment by utilizing all available bits within the image structure, contrasting with common steganographic practices that rely on less perceptible modifications like Least Significant Bit (LSB) manipulation. The use of specific filters, such as SUB in the scanline data, suggests a structured encoding method layered on top of standard image compression, which is then bypassed by specialized tools. This pattern signals an adversarial focus on technical complexity to obfuscate the payload rather than aesthetic degradation. The consequence is that when detection relies solely on visual inspection or simple metadata checks, the true intent—the presence of executable code—remains hidden until deep, specialized pixel-level analysis is performed. This forces a dichotomy: either a casual observer accepts the visually perfect image and misses the content, or a specialized analyst must engage in intense reconstruction to see the underlying malicious structure. The implications touch upon cognitive sovereignty by demonstrating that perceived innocence (a valid PNG) does not equate to actual security status, demanding a shift in trust regarding digital media integrity. What systems are put in place to evaluate data integrity beyond surface-level checks? How can analysts shift focus from identifying *what* is hidden to understanding *why* the totality of available bits was chosen for encoding?

From the original · SANS Internet Storm Center

TerminalFix: PNG Steganography Microsoft Security Research published an interesting blog post "TerminalFix campaign deploys a reverse tunnel through multistage intrusion" about a malware campaign. The aspect that I want to take a closer look at, is the fact that the threat actors used PNG files with steganography.

Read the full story at isc.sans.edu

Sentinel — Human

Confidence

The text reads like a detailed, single-author technical report or blog post detailing the steps taken during a security investigation, characterized by direct, process-oriented exposition.

Signals Detected

Moderate sentence length variance; uses technical jargon interspersed with more narrative flow.

Clear, logical progression of a forensic analysis from observation to interpretation and conclusion.

Does not exhibit verbatim talking points; the flow is exploratory rather than purely argumentative.

Specific technical details (PNG structure, filter types, bit manipulation) are highly detailed and contextually consistent with actual forensic methods.

Human Indicators

The use of direct engagement ('I want to take a closer look') and the transition from reporting a finding to walking through the technical verification steps suggests an investigative voice rather than pure aggregation.