Multi-Stage Loader Hides .NET Payloads in Image Pixels.
Source Reddit ThreatIntel
Discussion
RGBLoader is a multi-stage loader that hides .NET payloads within image pixel data, reconstructing and executing them directly in memory. It uses a three-stage extraction process involving Bitmap RGB values, ARGB pixel data with XOR decoding, and encrypted byte arrays from .NET resources. The loader dynamically passes configuration between stages to locate and decode payloads, launching recovered assemblies via Assembly.Load() and reflection. Payloads delivered by RGBLoader include known malware such as MassLogger, SnakeKeylogger, Quasar, Remcos, and cryptominers. Detection is challenging due to varying method, class, resource, and configuration names across samples, making static string-based detection unreliable.
r/threatintel (opens in a new tab)u/ANYRUN-team0 points0 comments
RGBLoader reconstructs .NET payloads from image pixel data and executes them directly in memory. The chain changes extraction techniques across three stages: Bitmap RGB values ➡️ .NET Stage 2 ➡️ ARGB pixel data + XOR ➡️ .NET Stage 3 ➡️ encrypted byte array from .NET resources ➡️ final payload
The loader passes configuration between stages to locate resources and decode the next payload, then launches recovered assemblies through Assembly.Load() and reflection.
Method, class, resource, and configuration names vary between samples, making static string-based detections unreliable. Focus on image-resource pixel extraction, staged .NET loading, and XOR-decoded resources.
RGBLoader’s payloads include MassLogger, SnakeKeylogger, Quasar, Remcos, and cryptominers. Trace the full in-memory DarkCloud delivery chain and collect IOCs: https://app.any.run/tasks/5ae24575-7ac3-49e8-a62c-f9ceb9b06d11/
- Formbook: https://app.any.run/tasks/648e990d-50fb-47e7-a279-a2dd41556d62/
- XWorm: https://app.any.run/tasks/2b69f5c9-ba69-40b3-a8fb-614ea5aaa896/
Related activity and evolution
IOCs:
85d1791847636949606bc1c87cdbfe019a43c5723333971dc820963016000c1b
5240b38a9efe67747c29da0026e03421942d4bb76d5619ed398e854480f6a076
38173492fece33a703a67140785e02cbd0749329b7cd9433bb7e122fbb9f803a
676e61504a6d6ab4d90b5068bc487fb19c804b0b1ef0db814aa04fbe035195dd
cdcd92f9e3af2925829eaf9e8d366ae2e750bded64d212484995378eb1839025
66d3101e3b2207acdbdd9d0c14a1c3ea064e14a771705d8a4583faecaba98544
7250576a3cb7164bf383d89683267604dd1a5d36e1a35f22b5bef2d9f29402e5
5da16030099b484460213d2031dc3683197eedbe54517c23e440f4f5af4c5daa
Links cited in the discussion
- https://app.any.run/tasks/5ae24575-7ac3-49e8-a62c-f9ceb9b06d11/
- https://app.any.run/tasks/648e990d-50fb-47e7-a279-a2dd41556d62/
- https://app.any.run/tasks/2b69f5c9-ba69-40b3-a8fb-614ea5aaa896/
- https://preview.redd.it/83fgvnprsszh1.png?width=2400&format=png&auto=webp&s=c808f0c105d7ea860b264f58a78219a3f5792504
References
- app.any.run/tasks/5ae24575-7ac3-49e8-a62c-f9ceb9b06d11/ (opens in a new tab)
- reddit.com/r/threatintel/comments/1xojlw9/multistage_loader_hides_net_payloads_in_image/ (opens in a new tab)
- app.any.run/tasks/648e990d-50fb-47e7-a279-a2dd41556d62/ (opens in a new tab)
- app.any.run/tasks/2b69f5c9-ba69-40b3-a8fb-614ea5aaa896/ (opens in a new tab)
- preview.redd.it/83fgvnprsszh1.png?width=2400&format=png&auto=webp&s=c808f0c105d7ea860b264f58a78219a3f5792504 (opens in a new tab)