Extreme Stealth: Python Malware Hides Inside PNG-Disguised RAR, Injects Payload into cvtres.exe

Researchers at K7 Labs have disclosed a highly obfuscated Python-based malware campaign that uses multi-layer encoding, masquerading as a PNG but actually containing a disguised RAR archive to deliver its payload, aiming to establish persistent C2 communications.

According to K7 Labs, the infection chain starts with a PE dropper that decrypts a payload at runtime and reconstructs a malicious config.bat, writing it to disk before the malware unfolds through a multi-step unpacking flow culminating in Python execution.

After downloading a file that appears harmless, the code reveals a RAR inside a PNG extension, with components such as AsusMouseDriver.sys (a password-protected RAR), Interput.json renamed to Install.bat, and Inx, a legitimate WinRAR helper used to unpack the hidden archive. The loader builds a fake Windows directory and loads a counterfeit ntoskrnl.exe that hosts the Python runtime, before launching a multilayer de-obfuscation sequence and executing the final marshalled Python bytecode in memory.

The malware then injects into cvtres.exe, enabling stealth and persistence, and subsequently establishes encrypted C2 traffic with a remote server to support a RAT with capabilities including command execution, file transfer and reconnaissance.