Malicious Payload Uncovered in JPEG Image Using Steganography and Base64 Obfuscation

In a sophisticated cybersecurity incident discovered on June 16, 2025, security researchers identified a malicious payload cleverly hidden within a JPEG image using a combination of steganography and modified Base64 encoding techniques.

The malware, embedded after the file’s End Of Image (EOI) marker, represents an evolving threat vector where seemingly innocuous image files serve as carriers for malicious code, bypassing traditional security mechanisms that often fail to inspect image content beyond rendering requirements.

The compromised image, distributed from the domain hxxps://zynova[.]kesug[.]com/new_image.jpg, appears normal when viewed but contains executable code appended to its structure.

This technique leverages the tolerance of image viewers and web browsers that typically ignore data beyond the image’s formal end marker, allowing threat actors to exploit this technical gap.

The payload delivery mechanism suggests a targeted approach rather than widespread distribution, indicating a potentially sophisticated threat actor with specific objectives.

Security implications of this technique are significant, as images are commonly shared across platforms with minimal security scrutiny.

The ability to hide executable code within seemingly harmless media files creates opportunities for initial access to secured environments, command-and-control communications, or data exfiltration channels that may evade detection by conventional security tools.

Internet Storm Center researchers noted that the malicious payload utilized an unusual obfuscation technique to further evade detection.

Analysis revealed that the standard Base64 alphabet was modified, with the character ‘@’ substituted for ‘A’ throughout the encoding process, creating an immediate challenge for automated detection systems that scan for standard Base64 patterns.

When properly decoded, the payload revealed a .NET DLL file beginning with the telltale “MZ” header characteristic of Windows executable files.

This discovery was made possible through specialized tools including jpegdump.py, which identified trailing data after the image’s structural end, and byte-stats.py, which revealed the statistical anomaly in character distribution that pointed to the Base64 substitution pattern.

Analysis of the Obfuscation Mechanism

The technical analysis of the malware reveals a multi-layered obfuscation approach. Initial examination of the appended data using the jpegdump.py tool showed a string beginning with “TVqQ” – which typically decodes to “MZ” in standard Base64, the magic header identifying Windows executable files.

However, the presence of ‘@’ characters where ‘A’ would normally appear presented an immediate detection challenge.

A statistical analysis using byte-stats.py confirmed the unusual character distribution, showing that every letter of the alphabet appeared in the payload except for ‘A’, strongly suggesting a deliberate substitution pattern.

The command base64dump.py -e @ A new_image.jpg successfully decoded the payload by replacing each ‘@’ with ‘A’ before standard Base64 decoding, resulting in the extraction of a complete .NET DLL file.

The extracted malware’s SHA256 hash matched previously documented samples, confirming its relationship to a known threat campaign.

This evasion technique demonstrates the ongoing cat-and-mouse game between threat actors and security researchers, where even small modifications to standard encoding schemes can temporarily bypass detection mechanisms.

Automate threat response with ANY.RUN’s TI Feeds—Enrich alerts and block malicious IPs across all endpoints -> Request full access