This sneaky Ghostpulse malware hides in PNG image files

Cybersecurity researchers from Elastic Security person uncovered a caller type of nan infamous Ghostpulse malware hiding successful nan pixels of a .PNG file.

In their method write-up, nan researchers explained nan malware’s operators proceed to show unthinkable levels of productivity and knowledge, arsenic they find caller ways to administer nan malware and hide it from antivirus programs and endpoint protection solutions.

The move marks a awesome displacement from Ghostpulse’s erstwhile obfuscation technique, which included abusing nan IDAT chunk of PNG files to hide malicious payloads, it was said.

Reading PNG files

To infect nan unfortunate pinch nan malware, nan crooks would first usage societal engineering to instrumentality nan unfortunate into visiting an attacker-controlled website. There, nan visitant would beryllium presented pinch what appeared to beryllium your modular CAPTCHA. However, alternatively of uncovering images of a canine aliases a occurrence hydrant, nan visitors are asked to property a circumstantial keyboard shortcut, which copies a malicious portion of JavaScript codification into nan clipboard.

That codification triggers a PowerShell book that downloads and runs nan Ghostpulse payload.

The payload is simply a azygous record - a “benign but compromised executable file” that includes a PNG record wrong its resources section. The malware useful by looking astatine nan circumstantial pixels and reference their colour to cod accusation hidden inside. The colors are surgery into mini chunks of data, which are past checked utilizing a type of “math test” to spot if they incorporate hidden malware instructions.

If they walk nan test, nan malware gathers nan information, and uses XOR to unlock and usage nan hidden instructions, yet infecting nan endpoint.

Ghostpulse is usually utilized arsenic a loader, deploying much vulnerable malware to nan compromised systems. Elastic Security recovered that astir of nan time, nan crooks usage it to deploy nan Lumma infostealer.

Via The Register

More from TechRadar Pro

• Sneaky malware abuses CAPTCHA to bypass browser protections
• Here's a database of nan best firewalls today
• We've besides rounded up nan best VPN pinch antivirus around