# Multi-Stage Steganographic Loader Delivers Remcos RAT and Rotating Infostealers via .NET Bitmap Resource Steganography and AppDomain.Load In-Memory Execution

> A loader-as-a-service phishing campaign delivers a packed 32-bit .NET dropper (e.g. 'GST Debit Note Apr_26.com') that hides next-stage DLLs inside a serialized .NET Bitmap in its resource section and loads them entirely in memory via AppDomain.Load to deploy Remcos RAT. The same infrastructure rotates a set of commodity infostealers (Agent Tesla, MassLogger, Phantom Stealer, RedLine, Formbook, Snake keylogger, DarkCloud, XWorm), with India-focused GST/NEFT/RTGS/IMPS banking lures inside a broader global campaign.

- **Published:** 2026-06-25T00:00:00Z
- **Last reviewed:** 2026-06-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0939
- **ID:** TL-2026-0939
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

K7 Labs (Harihara Sudhan) documented a polished, multi-stage steganographic loader campaign that ultimately deploys Remcos RAT and a rotating set of infostealers, operated as a loader-as-a-service. Initial access is phishing email with an archive attachment (MD5 C2E25ABA8E2AD4CAFDD6C633B8CA0906) that unpacks a 32-bit, unsigned, packed .NET executable disguised with a '.com' double extension (e.g. 'GST Debit Note Apr_26.com', MD5 897ABF678EDAD72998554EC18675092F). The dropper masquerades as a Turkish-language brick-building game and presents a decoy UI while it carries out malicious operations; the recurring metadata/assembly string 'TuglaInsaatci' ('brick builder' in Turkish) appears across linked loader samples.

The loader's defining tradecraft is resource-section steganography: an embedded resource (referenced as SR1) contains a serialized .NET System.Drawing.Bitmap object that is used purely as a container for a hidden byte array rather than as an image. At runtime the loader deserializes the Bitmap, reconstructs the embedded byte array, and calls AppDomain.Load on that byte array to load the second-stage assembly (Optimax.dll, MD5 AFE085B7324D72673EEF749FF5F21A49) entirely in memory, never writing it to disk. Optimax.dll repeats the technique to load a third-stage assembly (System Optimizer Ultimate.dll, MD5 F3626A38FCF488C9EED54BEB8C7C116F), which reconstructs and executes the final Remcos RAT payload (MD5 4924369C0BDAF73B21EB992EB9DB4DEA). This fully fileless in-memory chain minimizes forensic artifacts and defeats disk-based detection.

The final Remcos payload uses process hollowing to inject into the user's default browser process, masquerading legitimate network traffic. Persistence is established via a randomized, super-hidden self-copy under %AppData%\Roaming, a Run registry key for reinfection at logon, Winlogon userinit modification, and an obfuscated PowerShell script dropped to the temp directory. Anti-analysis includes sandbox detection (sbiedll.dll presence check), VM detection via registry markers (HARDWARE\ACPI\DSDT vbox_ artifacts), and a UAC bypass abusing eventvwr.exe (Event Viewer) to launch with elevated privileges. Remcos creates the mutex 'Remcos_Mutex_Inj', steals stored credentials and cookies from Chrome and Firefox into logs.dat, monitors active window titles and user idle time, logs window focus changes, and supports audio and webcam capture plus full remote command-and-control.

Observed Remcos C2 endpoints are 62.102.148.212:37393 (primary), 217.138.252.123:42830, and 146.70.244.90:37393 (the latter on commonly-abused VPN/bulletproof-style hosting). Because the delivery chain stays constant while the final payload is swapped per customer, the operation is assessed as loader-as-a-service. India-focused lures using GST/NEFT/RTGS/IMPS financial terminology indicate targeting of Indian recipients within a broader global victim set. No CVE is involved; this is a technique- and infrastructure-driven malware campaign with concrete, published IOCs.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1129 Shared Modules
- T1547.001 Registry Run Keys / Startup Folder
- T1547.004 Winlogon Helper DLL
- T1548.002 Bypass User Account Control
- T1027.003 Steganography
- T1027.002 Software Packing
- T1140 Deobfuscate/Decode Files or Information
- T1055.012 Process Hollowing
- T1620 Reflective Code Loading
- T1036.007 Double File Extension
- T1036.005 Match Legitimate Resource Name or Location
- T1112 Modify Registry
- T1564.001 Hidden Files and Directories
- T1497.001 System Checks
- T1555.003 Credentials from Web Browsers
- T1056.001 Keylogging
- T1497.001 System Checks
- T1518.001 Security Software Discovery
- T1010 Application Window Discovery
- T1124 System Time Discovery
- T1123 Audio Capture
- T1125 Video Capture
- T1113 Screen Capture
- T1115 Clipboard Data
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [A Multi-Stage Steganographic Loader Campaign Deploying Diverse Payloads Globally (K7 Security, Harihara Sudhan)](https://malpedia.caad.fkie.fraunhofer.de/library/0eadc1f5-0de2-48a4-9d04-90e2421d346a/)
- [Multi-Stage Steganographic Loader Deploys Remcos RAT and Multiple Infostealers Globally](https://gbhackers.com/steganographic-loader-deploys-remcos-rat/)
- [Malicious GST Debit Note Attachment Deploys Remcos RAT Through Multi-Stage Loader](https://cybersecuritynews.com/malicious-gst-debit-note-attachment-deploys-remcos-rat/)
- [Hackers Use Steganographic Loader to Deliver Remcos RAT via Phishing Attachments](https://cyberpress.org/steganographic-loader-delivers-remcos/)
- [K7 Labs reports a multi-stage, fileless Remcos loader campaign using steganography and in-memory DLL loading (MalwareTips)](https://malwaretips.com/threads/k7-labs-reports-a-multi-stage-fileless-remcos-loader-campaign-using-steganography-and-in-memory-dll-loading-to-evade-detection.141897/)
- [A Multi-Stage Steganographic Loader Campaign Deploying Diverse Payloads Globally (OffSeq Threat Radar)](https://radar.offseq.com/threat/a-multi-stage-steganographic-loader-campaign-deplo-997d31c2787c7c87)
- [Remcos RAT (Malpedia malware profile)](https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0939