CyberHawk Threat Intel — IOC Scanner, Live IOC Feed (3.6M+ indicators),
Infostealer Intelligence, Threat Map, MISP Feeds, GitHub Arsenal, Courses and more.
Free to join.
Register Free →
New malware that uses steganography always gets my attention, but I was disappointed when I looked at the latest DOUBLECUP write-up. It doesn't use real steganography:
You can see the PowerShell payload as cleartext: it has not been encoded into the pixels of the image.
It's even not embedded in the image (like inside the metadata), it's just appended after the PNG file:
Yet there is a clever little trick:
The PowerShell script starts with 0x0D 0x0A, Carriage-Return + Newline: that terminates a line of text in Windows.
That makes that you don't need a custom payload extractor, you can just use the FINDSTR command (Windows' grep) with a unique identifier to extract the script:
And then pipe it into the PowerShell interpreter.
Didier Stevens
Senior handler
blog.DidierStevens.com
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Accelerate Your Security Operations
CyberHawk Threat Intel is a complete Cyber Intelligence Platform — one place for every tool
a security professional needs. Built by
Rudra Verma,
Senior Security Architect and Researcher, CyberHawk Consultancy.
IOC Scanner — scan any domain, IP, hash, URL
Live IOC Feed — 3.6M+ indicators, filterable
Infostealer Intelligence — live compromised creds
Live Threat Map — real-time global attack vectors
MISP Threat Feeds — CIRCL, Feodo, Botvrij, more
GitHub Arsenal — curated security tools and scripts
Security Blog — CVE advisories and threat research
Video Courses — cybersecurity training and education
SOPs and Playbooks — SecOps procedures
Analyst Library — references and toolkits
Scan Reports — historical threat intelligence
Cyber News — this feed, aggregated in-platform
