Multi-Stage Steganographic Loader Delivers Remcos RAT and Rotating Infostealers via .NET Bitmap Resource Steganography and AppDomain.Load In-Memory Execution

Multi-Stage Steganographic Loader Delivers Remcos RAT and (TL-2026-0939), also tracked as TuglaInsaatci Loader, is a high-severity malware campaign, first published 2026-06-25. It has no confirmed attribution, affects Microsoft Windows, maps to 32 MITRE ATT&CK techniques (T1005, T1010, T1027.002), and is covered by 9 detection rules and 32 indicators of compromise.

Key facts for TL-2026-0939

Threat ID
TL-2026-0939
Also known as
TuglaInsaatci Loader, GST Debit Note Loader
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-06-25
Last reviewed
2026-06-25
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
financial, government, small and medium business, technology
Target regions
India, Asia, Global
Detection rules
9
Indicators of compromise
32

Malware and tooling in Multi-Stage Steganographic Loader Delivers Remcos RAT and

Malware and tooling: 404 Keylogger, Agent Tesla, DarkCloud, Formbook, MASS Logger, Phantom Stealer, RedLine Stealer - S1240, Remcos, XWorm

A loader-as-a-service phishing campaign delivers a packed 32-bit .NET dropper (e.g. 'GST Debit Note Apr_26.com') that hides next-stage DLLs inside a serialized .NET Bitmap in its resource section and loads them entirely in memory via AppDomain.Load to deploy Remcos RAT. The same infrastructure rotates a set of commodity infostealers (Agent Tesla, MassLogger, Phantom Stealer, RedLine, Formbook, Snake keylogger, DarkCloud, XWorm), with India-focused GST/NEFT/RTGS/IMPS banking lures inside a broader global campaign.

How Multi-Stage Steganographic Loader Delivers Remcos RAT and works

K7 Labs (Harihara Sudhan) documented a polished, multi-stage steganographic loader campaign that ultimately deploys Remcos RAT and a rotating set of infostealers, operated as a loader-as-a-service. Initial access is phishing email with an archive attachment (MD5 C2E25ABA8E2AD4CAFDD6C633B8CA0906) that unpacks a 32-bit, unsigned, packed .NET executable disguised with a '.com' double extension (e.g. 'GST Debit Note Apr_26.com', MD5 897ABF678EDAD72998554EC18675092F). The dropper masquerades as a Turkish-language brick-building game and presents a decoy UI while it carries out malicious operations; the recurring metadata/assembly string 'TuglaInsaatci' ('brick builder' in Turkish) appears across linked loader samples.

The loader's defining tradecraft is resource-section steganography: an embedded resource (referenced as SR1) contains a serialized .NET System.Drawing.Bitmap object that is used purely as a container for a hidden byte array rather than as an image. At runtime the loader deserializes the Bitmap, reconstructs the embedded byte array, and calls AppDomain.Load on that byte array to load the second-stage assembly (Optimax.dll, MD5 AFE085B7324D72673EEF749FF5F21A49) entirely in memory, never writing it to disk. Optimax.dll repeats the technique to load a third-stage assembly (System Optimizer Ultimate.dll, MD5 F3626A38FCF488C9EED54BEB8C7C116F), which reconstructs and executes the final Remcos RAT payload (MD5 4924369C0BDAF73B21EB992EB9DB4DEA). This fully fileless in-memory chain minimizes forensic artifacts and defeats disk-based detection.

The final Remcos payload uses process hollowing to inject into the user's default browser process, masquerading legitimate network traffic. Persistence is established via a randomized, super-hidden self-copy under %AppData%\Roaming, a Run registry key for reinfection at logon, Winlogon userinit modification, and an obfuscated PowerShell script dropped to the temp directory. Anti-analysis includes sandbox detection (sbiedll.dll presence check), VM detection via registry markers (HARDWARE\ACPI\DSDT vbox_ artifacts), and a UAC bypass abusing eventvwr.exe (Event Viewer) to launch with elevated privileges. Remcos creates the mutex 'Remcos_Mutex_Inj', steals stored credentials and cookies from Chrome and Firefox into logs.dat, monitors active window titles and user idle time, logs window focus changes, and supports audio and webcam capture plus full remote command-and-control.

Observed Remcos C2 endpoints are 62.102.148.212:37393 (primary), 217.138.252.123:42830, and 146.70.244.90:37393 (the latter on commonly-abused VPN/bulletproof-style hosting). Because the delivery chain stays constant while the final payload is swapped per customer, the operation is assessed as loader-as-a-service. India-focused lures using GST/NEFT/RTGS/IMPS financial terminology indicate targeting of Indian recipients within a broader global victim set. No CVE is involved; this is a technique- and infrastructure-driven malware campaign with concrete, published IOCs.

MITRE ATT&CK techniques used in TL-2026-0939

Collection

T1005 Data from Local System; T1113 Screen Capture; T1115 Clipboard Data; T1123 Audio Capture; T1125 Video Capture

Discovery

T1010 Application Window Discovery; T1124 System Time Discovery; T1497.001 System Checks; T1518.001 Security Software Discovery

Defense Evasion

T1027.002 Software Packing; T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1036.007 Double File Extension; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1564.001 Hidden Files and Directories; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Credential Access

T1056.001 Keylogging; T1555.003 Credentials from Web Browsers

Execution

T1059.001 PowerShell; T1129 Shared Modules; T1204.002 Malicious File

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port

defense-impairment

T1112 Modify Registry

Persistence

T1547.001 Registry Run Keys / Startup Folder; T1547.004 Winlogon Helper DLL

Privilege Escalation

T1548.002 Bypass User Account Control

Initial Access

T1566 Phishing; T1566.001 Spearphishing Attachment

Affected products and versions in Multi-Stage Steganographic Loader Delivers Remcos RAT and

  • Microsoft — Windows
    Vulnerable versions: Windows endpoints running the .NET Framework

Remediation for Multi-Stage Steganographic Loader Delivers Remcos RAT and

Immediate actions

  • Block C2 IPs 62.102.148.212, 217.138.252.123, and 146.70.244.90 at the perimeter and over ports 37393 and 42830
  • Quarantine and hunt for the listed file hashes across the estate
  • Block inbound archive attachments containing executables with double extensions such as '.com' (e.g. 'GST Debit Note Apr_26.com')
  • Hunt for the mutex 'Remcos_Mutex_Inj' and the artifact file logs.dat in user profiles

Workarounds

  • Strip or sandbox archive attachments at the mail gateway; warn users on tax/banking-themed lures
  • Block execution of files with deceptive '.com'/double extensions via attack-surface-reduction rules

Longer-term hardening

  • Deploy behavioral EDR with in-memory/.NET assembly load visibility (AppDomain.Load / Assembly.Load on byte arrays)
  • Enforce application control and code-signing so unsigned packed .NET executables cannot run
  • Enable PowerShell script-block and module logging to catch the obfuscated dropped script
  • Disable or restrict the eventvwr.exe UAC-bypass path and monitor for browser processes spawned in a hollowed state

Weaknesses (CWE) in Multi-Stage Steganographic Loader Delivers Remcos RAT and

CWE-506, CWE-507

Timeline of Multi-Stage Steganographic Loader Delivers Remcos RAT and

  • Remcos ('Remote Control & Surveillance') is first marketed by Breaking Security as a commercial remote-administration tool; it is subsequently adopted broadly as commodity RAT/malware, providing the lineage of the final payload in this campaign.
  • Lure documents reference April 2026 GST debit-note billing (e.g. 'GST Debit Note Apr_26.com'), consistent with the campaign's financial/tax theme.
  • Findings independently reported by gbhackers, CyberSecurityNews, CyberPress, and OffSeq Threat Radar.
  • Linked infrastructure observed rotating commodity infostealers (Agent Tesla, MassLogger, Phantom Stealer, RedLine, Formbook, Snake Keylogger, DarkCloud, XWorm), leading to a loader-as-a-service assessment.
  • Sample MD5 hashes and three Remcos C2 endpoints (62.102.148.212:37393, 217.138.252.123:42830, 146.70.244.90:37393) published.
  • Final Remcos payload behavior documented: process hollowing into the default browser, eventvwr.exe UAC bypass, Run-key/Winlogon persistence, sandbox/VM evasion, and Chrome/Firefox credential and cookie theft into logs.dat.
  • Serialized .NET Bitmap resource (SR1) steganography plus the AppDomain.Load in-memory chain (Optimax.dll -> System Optimizer Ultimate.dll -> Remcos) documented as the loader's core fileless tradecraft.
  • Delivery chain documented: phishing archive attachment unpacks a packed 32-bit .NET dropper using a deceptive '.com' double extension and a Turkish brick-building-game ('TuglaInsaatci') decoy UI.
  • K7 Labs (Harihara Sudhan) publishes analysis of the multi-stage steganographic loader deploying Remcos RAT and rotating infostealers; indexed by Malpedia.
  • Threat ingested and analyzed into the Threadlinqs Intelligence platform as TL-2026-0939.

Sources cited for Multi-Stage Steganographic Loader Delivers Remcos RAT and

Threats related to Multi-Stage Steganographic Loader Delivers Remcos RAT and

Detection coverage for TL-2026-0939

As of 2026-06-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0939 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-0939

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats