New Steganographic Campaign Distributing Multiple Malware

Executive summary: This report analyzes a multi-stage steganographic phishing campaign that begins with a weaponized Excel exploit (CVE-2017-0199) and uses HTA/VBS scripts to download JPG images that conceal base64-encoded VB.NET injector DLLs; the DLLs perform process hollowing to deploy Remcos and AsyncRAT (remote access/infostealer capabilities). The analysis includes payload behavior, extracted configuration (C2 domains/IPs, ports, mutex, botnet name), file hashes, detection names, and MITRE ATT&CK mappings, highlighting the campaign's use of masquerading, obfuscation, and steganography to evade detection.