[SANS ISC] ShellCode Hidden with Steganography

Today, I published the following diary on isc.sans.edu: “ShellCode Hidden with Steganography“:

When hunting, I’m often surprised by the interesting pieces of code that you may discover… Attackers (or pentesters/redteamers) like to share scripts on VT to evaluate the detection rates against many antivirus products. Sometimes, you find something cool stuffs.

Yesterday, I found a small Python script that inject a shellcode into memory but, this time, the payload is hidden in a PNG picture using a well-known …

antivirus attackers code detection discover edu find hidden hunting isc may products sans sans.edu sans isc scripts share shellcode steganography today