OceanLotus Steganography Malware Analysis White Paper

This white paper analyzes OceanLotus (APT32) use of custom steganographic PNG loaders that conceal AES128-encrypted payloads in image pixels, decrypt and XOR-deobfuscate them, then execute multi-stage backdoors (Denes and Remy variants). It documents two loader variants with anti-analysis and injection techniques, dissects the launcher, backdoor and C2 modules, and provides extensive IOCs (file hashes, embedded keys/IVs, C2 domains, registry paths), YARA rules and a Python decoder to aid detection and hunting.