{ "id": "14bfac2a-c1f2-4b25-8a27-46a1a36b3b9f", "created_at": "2026-04-06T01:31:28.5382Z", "updated_at": "2026-04-10T03:34:22.781409Z", "deleted_at": null, "sha1_hash": "7a594e92aefba30881c69190a9a48c1376c2a2ba", "title": "GitHub-hosted malware calculates Cobalt Strike payload from Imgur pic", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1502752, "plain_text": "GitHub-hosted malware calculates Cobalt Strike payload from Imgur pic\r\nBy Ax Sharma\r\nPublished: 2020-12-28 · Archived: 2026-04-06 01:04:18 UTC\r\nA new strand of malware uses Word files with macros to download a PowerShell script from GitHub.\r\nThis PowerShell script further downloads a legitimate image file from image hosting service Imgur to decode a Cobalt\r\nStrike script on Windows systems.\r\nMultiple researchers have potentially linked this strain to MuddyWater (aka SeedWorm and TEMP.Zagros), a government-backed advanced persistent threat (APT) group, first observed in 2017 while mainly targeting Middle Eastern entities.\r\nhttps://www.bleepingcomputer.com/news/security/github-hosted-malware-calculates-cobalt-strike-payload-from-imgur-pic/\r\nPage 1 of 5\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/github-hosted-malware-calculates-cobalt-strike-payload-from-imgur-pic/\r\nPage 2 of 5\n\nVisit Advertiser websiteGO TO PAGE\r\nWord macro spins up PowerShell script hosted on GitHub\r\nThis week researcher Arkbird has shared details on a new macro-based malware that is evasive and spawns payload in\r\nmultifaceted steps.\r\nThe malware strand which looks \"like MuddyWater,\" according to the researcher, ships as an embedded macro within a\r\nlegacy Microsoft Word (*.doc) file, in the style of the APT group.\r\nIn tests by BleepingComputer, when the Word document is opened, it runs the embedded macro. The macro further\r\nlaunches powershell.exe and feeds it the location of a PowerShell script hosted on GitHub (archived).\r\nMacro script embedded within the malicious Word doc\r\nSource: BleepingComputer \r\nThe single-line PowerShell script has instructions to download a real PNG file (shown below) from the image hosting\r\nservice Imgur.\r\nWhile this image itself may be benign, its pixel values are used by the PowerShell script in calculating the next stage\r\npayload. \r\nMalware calculates the next stage payload by decoding the pixel values within this image\r\nSource: Imgur\r\nThe technique of hiding code, secret data, or malicious payload within ordinary files, such as images, is known as\r\nsteganography. \r\nTools like Invoke-PSImage make this possible by encoding a PowerShell script within the pixels of a PNG file and\r\ngenerating a one-line command to execute the payload.\r\nAs observed by BleepingComputer and shown below, the payload calculation algorithm runs a foreach loop to iterate over a\r\nset of pixel values within the PNG image and performs specific arithmetic operations to obtain functional ASCII commands.\r\nhttps://www.bleepingcomputer.com/news/security/github-hosted-malware-calculates-cobalt-strike-payload-from-imgur-pic/\r\nPage 3 of 5\n\nPowerShell script hosted on GitHub downloads PNG from Imgur and uses it to calculate the payload\r\nSource: BleepingComputer\r\nDecoded script executes Cobalt Strike payload\r\nThe decoded script obtained from manipulating the PNG's pixel values is a Cobalt Strike script.\r\nCobalt Strike is a legitimate penetration testing toolkit that allows attackers to deploy \"beacons\" on compromised devices to\r\nremotely \"create shells, execute PowerShell scripts, perform privilege escalation, or spawn a new session to create a listener\r\non the victim system.\"\r\nIn fact, the decoded shellcode comprises an EICAR string to trick security tools and SOC teams into mistaking this\r\nmalicious payload for an antivirus test being performed by security professionals. \r\nThe payload, however, indeed contacts the command-and-control (C2) server via a WinINet module to receive further\r\ninstructions, according to Arkbird.\r\nThe domain associated with the C2 server Mazzion1234-44451.portmap.host was no longer accessible at the time of writing.\r\nHowever, the researcher noted \"the domain has been recorded near 20 December 2020. The GitHub account has got the\r\nscript pushed the 24 December, the date of the submission in [VirusTotal].\"\r\nThe emergence of this evasive malware strain around the holiday season gains adversaries another advantage: to mask their\r\nfootsteps when most staff is likely to be away and less vigilant.\r\nWhile authoritative attribution is challenging given the possibility of copycat attacks, security researcher Florian Roth from\r\nNextron Systems has added the Indicators of Compromise (IOCs) associated with this malware to MuddyWater IOCs list.\r\nThe researcher has also provided YARA rules that can be used to detect the variant in your environment.\r\nIOCs associated with the macro-laden Word documents used in this malware campaign are given below:\r\n1. d1c7a7511bd09b53c651f8ccc43e9c36ba80265ba11164f88d6863f0832d8f81\r\n2. ed93ce9f84dbea3c070b8e03b82b95eb0944c44c6444d967820a890e8218b866\r\nIf you receive a suspicious Word document in a phishing email or via any other means, do not open it or run \"macros\" within\r\nit. \r\nThis is not the first time legitimate services like GitHub and Imgur have been abused to serve malicious code.\r\nRecently, wormable botnet Gitpaste-12 leveraged both GitHub and Pastebin to host its malicious payload and evade\r\ndetection.\r\nAdditionally, ransomware groups like CryLocker have been known to abuse Imgur for data storage.\r\nhttps://www.bleepingcomputer.com/news/security/github-hosted-malware-calculates-cobalt-strike-payload-from-imgur-pic/\r\nPage 4 of 5\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/github-hosted-malware-calculates-cobalt-strike-payload-from-imgur-pic/\r\nhttps://www.bleepingcomputer.com/news/security/github-hosted-malware-calculates-cobalt-strike-payload-from-imgur-pic/\r\nPage 5 of 5", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://www.bleepingcomputer.com/news/security/github-hosted-malware-calculates-cobalt-strike-payload-from-imgur-pic/" ], "report_names": [ "github-hosted-malware-calculates-cobalt-strike-payload-from-imgur-pic" ], "threat_actors": [ { "id": "610a7295-3139-4f34-8cec-b3da40add480", "created_at": "2023-01-06T13:46:38.608142Z", "updated_at": "2026-04-10T02:00:03.03764Z", "deleted_at": null, "main_name": "Cobalt", "aliases": [ "Cobalt Group", "Cobalt Gang", "GOLD KINGSWOOD", "COBALT SPIDER", "G0080", "Mule Libra" ], "source_name": "MISPGALAXY:Cobalt", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "02e1c2df-8abd-49b1-91d1-61bc733cf96b", "created_at": "2022-10-25T15:50:23.308924Z", "updated_at": "2026-04-10T02:00:05.298591Z", "deleted_at": null, "main_name": "MuddyWater", "aliases": [ "MuddyWater", "Earth Vetala", "Static Kitten", "Seedworm", "TEMP.Zagros", "Mango Sandstorm", "TA450" ], "source_name": "MITRE:MuddyWater", "tools": [ "STARWHALE", "POWERSTATS", "Out1", "PowerSploit", "Small Sieve", "Mori", "Mimikatz", "LaZagne", "PowGoop", "CrackMapExec", "ConnectWise", "SHARPSTATS", "RemoteUtilities", "Koadic" ], "source_id": "MITRE", "reports": null }, { "id": "2ed8d590-defa-4873-b2de-b75c9b30931e", "created_at": "2023-01-06T13:46:38.730137Z", "updated_at": "2026-04-10T02:00:03.08136Z", "deleted_at": null, "main_name": "MuddyWater", "aliases": [ "TEMP.Zagros", "Seedworm", "COBALT ULSTER", "G0069", "ATK51", "Mango Sandstorm", "TA450", "Static Kitten", "Boggy Serpens", "Earth Vetala" ], "source_name": "MISPGALAXY:MuddyWater", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "156b3bc5-14b7-48e1-b19d-23aa17492621", "created_at": "2025-08-07T02:03:24.793494Z", "updated_at": "2026-04-10T02:00:03.634641Z", "deleted_at": null, "main_name": "COBALT ULSTER", "aliases": [ "Boggy Serpens ", "ENT-11 ", "Earth Vetala ", "ITG17 ", "MERCURY ", "Mango Sandstorm ", "MuddyWater ", "STAC 1171 ", "Seedworm ", "Static Kitten ", "TA450 ", "TEMP.Zagros ", "UNC3313 ", "Yellow Nix " ], "source_name": "Secureworks:COBALT ULSTER", "tools": [ "CrackMapExec", "Empire", "FORELORD", "Koadic", "LaZagne", "Metasploit", "Mimikatz", "Plink", "PowerStats" ], "source_id": "Secureworks", "reports": null }, { "id": "3c430d71-ab2b-4588-820a-42dd6cfc39fb", "created_at": "2022-10-25T16:07:23.880522Z", "updated_at": "2026-04-10T02:00:04.775749Z", "deleted_at": null, "main_name": "MuddyWater", "aliases": [ "ATK 51", "Boggy Serpens", "Cobalt Ulster", "G0069", "ITG17", "Mango Sandstorm", "MuddyWater", "Operation BlackWater", "Operation Earth Vetala", "Operation Quicksand", "Seedworm", "Static Kitten", "T-APT-14", "TA450", "TEMP.Zagros", "Yellow Nix" ], "source_name": "ETDA:MuddyWater", "tools": [ "Agentemis", "BugSleep", "CLOUDSTATS", "ChromeCookiesView", "Cobalt Strike", "CobaltStrike", "CrackMapExec", "DCHSpy", "DELPHSTATS", "EmPyre", "EmpireProject", "FruityC2", "Koadic", "LOLBAS", "LOLBins", "LaZagne", "Living off the Land", "MZCookiesView", "Meterpreter", "Mimikatz", "MuddyC2Go", "MuddyRot", "Mudwater", "POWERSTATS", "PRB-Backdoor", "PhonyC2", "PowGoop", "PowerShell Empire", "PowerSploit", "Powermud", "QUADAGENT", "SHARPSTATS", "SSF", "Secure Socket Funneling", "Shootback", "Smbmap", "Valyria", "chrome-passwords", "cobeacon", "prb_backdoor" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775439088, "ts_updated_at": 1775792062, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/7a594e92aefba30881c69190a9a48c1376c2a2ba.pdf", "text": "https://archive.orkl.eu/7a594e92aefba30881c69190a9a48c1376c2a2ba.txt", "img": "https://archive.orkl.eu/7a594e92aefba30881c69190a9a48c1376c2a2ba.jpg" } }