#threatreport #LowCompleteness
Malicious PixelCode Delivery Technique | 21-01-2026
Source:
github.com/S3N4T0R-0X0/Malic…
Key details below ↓
💀Threats:
Pixelcode_technique, Bear-c2,
📚TTPs:
⚔️Tactics: 1
🛠️Technics: 0
🤖LLM extracted TTPs:`
T1027, T1036, T1059.001, T1059.003, T1071.001, T1105, T1140, T1573.001
🧨IOCs:
- File: 2
- Path: 1
🔢Algorithms: base64, aes-cbc
📜Programming Languages: powershell, python
#threatreport:
The Malicious PixelCode Delivery Technique illustrates an innovative method for encoding executable files into pixel data embedded within images or videos. This approach is primarily aimed at demonstrating covert data delivery and obfuscation tactics that can be misappropriated by malicious actors. By converting malware into a visual format, attackers can disguise harmful binaries or scripts as innocuous multimedia content, thereby enhancing their evasion strategies against detection mechanisms.
A specific example of this technique includes a stealthy Windows reverse shell payload implemented in C . This payload is designed to maintain a persistent connection to a command and control server through AES-CBC encryption, employing a hardcoded static key coupled with random initialization vectors for secure communication. It identifies itself with a unique identifier, executes commands via cmd.exe or PowerShell, supports directory navigation, and streams command output in real time. Importantly, it operates without displaying a console window and is capable of automatically reconnecting if the connection is disrupted, functioning effectively as a remote access trojan aimed at post-exploitation phase control.
To facilitate the embedding of the payload into pixels, the compiled executable is processed using a Python-based tool specifically crafted to convert the binary data into so-called Pixel Code. This conversion results in a visual representation, often as an MP4 file, whereby the binary information is interwoven with pixel values across video frames.
Since the original C payload lacks the necessary multimedia libraries for decoding the Pixel Code back into its executable form, a Python stager is employed for this purpose. This Python script is compiled into an executable and then Base64-encoded, enabling it to be directly embedded within the main C loader code alongside a YouTube URL, which serves as a medium for retrieval.
Once the MP4 video is downloaded, the Python stager processes it frame by frame, extracting the encoded pixel data and reconstructing the original executable in memory. This operation showcases an advanced technique for obfuscation and delivery of malware, allowing attackers new avenues for executing malicious code covertly.