value:  MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg. ;; Okrum's payload is encrypted and embedded within its loader or within a legitimate PNG file. ;; PolyglotDuke can use steganography to hide C2 information in images. ;; PowerDuke uses steganography to hide backdoors in PNG files which are also encrypted using the Tiny Encryption Algorithm (TEA). ;; Raindrop used steganography to locate the start of its encoded payload within legitimate 7-Zip code. ;; Ramsay has PE data embedded within JPEG files contained within Word documents. ;; RDAT can also embed data within a BMP image prior to exfiltration. ;; RegDuke can hide data in images including use of the Least Significant Bit (LSB). ;; TA551 has hidden encoded data for malware DLLs in a PNG. ;; Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.
name: Obfuscated Files or Information: Steganography