TerminalFix: PNG Steganography, (Mon, Sep 21st)
SANS analyzes the TerminalFix malware campaign, which hides a malicious DLL inside PNG pixel data via steganography and DLL side-loading.
SANS handler Didier Stevens dissects PNG IOCs from a Microsoft Security Research report on the TerminalFix campaign, which deploys a reverse tunnel through multistage intrusion. The PNGs are structurally valid (IHDR, IDAT, IEND, RGBA, 111x112 pixels) but all pixel bits encode payload data rather than a visible image. The raw bitmap begins with a little-endian PE length (49,720 bytes), enabling carving of a genuine Microsoft LockScreenContentServer.exe used for side-loading. Two further PNGs each contain half of a malicious DLL that is concatenated to form the payload.
- PNG files pass structural checks; payload hides in IDAT pixel data using all bits, not LSB steganography.
- Raw bitmap starts with little-endian PE length (49,720 bytes), letting analysts carve the embedded executable.
- Embedded PE is genuine LockScreenContentServer.exe used for DLL side-loading execution.
- Two additional PNGs each store half of a malicious DLL; concatenating parts yields the payload.
- Campaign reported by Microsoft as a multistage intrusion deploying a reverse tunnel.
- ATT&CK
- T1027.003 Obfuscated Files or Information: SteganographyT1574.002 Hijack Execution Flow: DLL Side-LoadingT1572 Protocol Tunneling
- Products
- LockScreenContentServer.exe
- Threat actors
- TerminalFix
- Organizations
- SANS Internet Storm Center
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | blog.didierstevens.com | he payload, a malicious DLL . Didier Stevens Senior handler blog.DidierStevens.com (c) SANS Internet Storm Center. https://isc.sans.edu Creati |
| sha256 | f5f1eb6d43dd61d5b069c250e5c666384f7417d0c95014773bf9edf8ff13bebe | he PNG files with me. The first image is a small PNG file ( f5f1eb6d43dd61d5b069c250e5c666384f7417d0c95014773bf9edf8ff13bebe ). Analysis with pngdump.py reveals that this is a proper P |
From the original article
3 min read at isc.sans.edu
Microsoft Security Research published an interesting blog post "TerminalFix campaign deploys a reverse tunnel through multistage intrusion" about a malware campaign. The aspect that I want to take a closer look at, is the fact that the threat actors used PNG files with steganography. I reached out to the researchers and they kindly shared the IOCs for the PNG files with me.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.