Stealth Stealer: New .NET Loader Hides LokiBot Payload in BMP/PNG Images Using Advanced Steganography

The Splunk Threat Research Team (STRT) has uncovered a new variant of a .NET steganographic loader that hides malicious payloads inside image files and ultimately deploys LokiBot, a credential-stealing trojan. The researchers note that in August 2025 a similar loader used steganography to deliver malware such as Quasar RAT, but the new variant adds an extra evasion module.

According to Splunk, the loader disguises itself as a legitimate business document, for example using “Request for Quotation (RFQ)” language to entice victims. Unlike earlier variants, this loader decrypts a separate “container” module at runtime, with two image files embedded in the .NET resource metadata that contain hidden stager components encrypted with the same algorithm.

The container includes two files, crc[.]bmp and IVBD[.]png, and after modifying a PowerShell steganography tool to decode directly on the BMP and PNG files, researchers extracted two stager modules and finally revealed the LokiBot payload. LokiBot has existed for over a decade and targets browser passwords, email clients, FTP tools, password managers, cryptocurrency wallets, Windows credentials, and application configuration files.