Pixels to Payload: Dissecting a Four-Stage Bitmap-Steganography Dropper Delivering AsyncRAT

Sat, 18 Jul 2026 11:00:00 +0000

Note: The bulk of this analysis and write-up was produced with the Kimi K3 large language model.

Summary

The sample analysed here is a four-stage .NET delivery chain that deploys AsyncRAT version 0.5.8. The outer binary poses as an Armenian-language water-cycle simulation, complete with a functioning particle engine, control panel, and live charts. Its two bitmap resources are not artwork. They are payload carriers, and the code that reads them uses Bitmap.GetPixel as a steganographic carving tool.

AsyncRAT on Rhys Downing

Pixels to Payload: Dissecting a Four-Stage Bitmap-Steganography Dropper Delivering AsyncRAT

Summary