Trusted Design

A Multi-Stage Steganographic Loader Campaign Deploying Diverse Payloads Globally

概要

A sophisticated phishing campaign was identified distributing multiple malware families through a multi-stage loader utilizing steganography and fileless techniques. The infection chain begins with archive attachments containing files disguised as financial documents, primarily targeting Indian organizations using names related to GST, NEFT, RTGS, and IMPS transactions. The loader employs in-memory execution to avoid disk-based artifacts and uses embedded .NET Bitmap objects to conceal payloads. Various malware families have been deployed including Remcos RAT, Agent Tesla, MassLogger, Phantom Stealer, Dark Cloud, Red Line Stealer, Snake keyloggers, Formbook, and xworm. The final payloads establish persistence through registry Run keys, perform process hollowing, steal browser credentials, record audio and webcam, and exfiltrate data to command-and-control infrastructure. The campaign exhibits characteristics of a loader-as-a-service operation serving multiple threat actors globally.

Created: 2026-06-23

Indicators

• FileHash-SHA1 - be36ef651eed6808760153200a3a2a2b7060cce5 -
• FileHash-SHA256 - 372f19a45d0eb4c8c52117c6ae2bb8040a91bc72be8670623f957a18c2166985 -
• FileHash-MD5 - 897abf678edad72998554ec18675092f -
• FileHash-MD5 - 4924369c0bdaf73b21eb992eb9db4dea -
• FileHash-MD5 - f3626a38fcf488c9eed54beb8c7c116f -
• FileHash-MD5 - c2e25aba8e2ad4cafdd6c633b8ca0906 -
• FileHash-MD5 - afe085b7324d72673eef749ff5f21a49 -

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る