Steganography Hidden PE Payload in Image File - Remcos RAT Loader
Detects PNG or BMP image files used as steganographic carriers for hidden PE payloads. This rule specifically looks for PE (Portable Executable) headers (MZ and PE signatures) either appended after the PNG IEND (End of Image) marker or embedded within a high-entropy BMP file, indicating a hidden executable payload. This technique has been observed in multi-stage Remcos RAT loader campaigns.
YARA
