SnappyClient Malware Uses HijackLoader for Remote Access and Cryptocurrency Theft
Summary
ThreatLabz analyzed SnappyClient, a HijackLoader-delivered malware implant with remote-access and data-theft capabilities. Its observed activity targets cryptocurrency users, including browser credentials, wallet data, and clipboard contents.
Key points
- ThreatLabz identified SnappyClient in December 2025; observed delivery methods include a fake telecom website targeting German speakers and a ClickFix chain involving GhostPulse/HijackLoader.
- The C++ implant supports keylogging, screenshots, remote shell access, file operations, browser and application data theft, and remote control.
- It evades detection using an AMSI bypass, Heaven’s Gate, direct system calls, and transacted hollowing.
- SnappyClient communicates with its C2 over a custom TCP protocol, encrypting messages with ChaCha20-Poly1305 and using separate control and data sessions.
- Observed targeting includes cryptocurrency wallets and browser extensions; clipboard and window-title matches can trigger screenshots, and wallet-related software data is collected.
- ThreatLabz found code similarities with HijackLoader, which was the only loader observed delivering SnappyClient, but described a developer connection as possible rather than confirmed.
Article Details
- Attack Vectors
- A website impersonating a telecommunications company targeted German-speaking users and automatically downloaded a HijackLoader executable; if executed, HijackLoader decrypted and loaded SnappyClient.
- A separate reported delivery chain involved a GhostPulse/HijackLoader intrusion via ClickFix, with SnappyClient as the payload.
- SnappyClient supports browser and application data theft, keylogging, screenshots, remote-shell commands, file operations, and downloading files from a C2-provided URL.
- Defensive Notes
- SnappyClient hooks AmsiScanBuffer and AmsiScanString to return AMSI_RESULT_CLEAN, bypassing AMSI scanning.
- SnappyClient uses Heaven’s Gate for x64 direct system calls and transacted hollowing to inject a payload into a trusted process.
- Zscaler reports that its cloud security platform detects indicators related to SnappyClient and the campaign.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 151[.]242[.]122[.]227 | SnappyClient C2 address; the article lists ports 3333 for control sessions and 3334 for data sessions. |
| IPV4 | 179[.]43[.]167[.]210 | SnappyClient C2 address; the article lists ports 3333 for control sessions and 3334 for data sessions. |
| SHA256 | 00019221fb0b61b769d4168664f11c1258e4d61659bd3ffecb126eaf92dbfe2f | Hash of a SnappyClient v0.1.8 sample. |
| SHA256 | 23e2a0c25c95eebe1a593b27ac1b81a73b23ddad7617b3b11c69a89c3d49812e | Hash of a SnappyClient v0.1.9 sample. |
| SHA256 | 61e103db36ebb57770443d9249b5024ee0ae4c54d17fe10c1d44e87e2fc5ee99 | Hash of a SnappyClient v0.1.11 sample. |
| SHA256 | 64a2609d6707a2ebfe5b40f5227d0f9b85911b752cd04f830d1bbc8aa6bec2c8 | Hash of a SnappyClient v0.1.5 sample. |
| SHA256 | 6e360fca0b1e3021908f8de271d80620d634600955fefc9fd0af40557cd517d7 | Hash of a SnappyClient v0.1.7 sample. |
MITRE ATT&CK
T1005 · Data from Local SystemSnappyClient collects files from configured browser, extension, and other application data locations.T1041 · Exfiltration Over C2 ChannelSnappyClient sends collected files and other stolen data to its C2.T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolAn EventsDB action can exfiltrate matching clipboard data over HTTP to a configured URL.T1053.005 · Scheduled TaskSnappyClient can establish persistence with a scheduled task triggered at the current user’s logon.T1055.012 · Process HollowingSnappyClient uses transacted hollowing to inject a payload into a trusted process to retrieve Chromium’s AES-256 master key.T1056.001 · KeyloggingSnappyClient captures victim keystrokes in an encrypted keylogger file.T1059 · Command and Scripting InterpreterSnappyClient provides a remote-shell command that initializes a shell and executes commands supplied by the C2.T1083 · File and Directory DiscoverySnappyClient can browse directories, search for files, and report matching file paths to the C2.T1105 · Ingress Tool TransferC2 commands can direct SnappyClient to download a file from a supplied URL and save it to a specified path.T1113 · Screen CaptureSnappyClient captures screenshots of the foreground window or a selected monitor and sends them to the C2.T1115 · Clipboard DataSnappyClient checks clipboard contents, can replace them, and can exfiltrate matching clipboard data.T1539 · Steal Web Session CookieSnappyClient has a command to collect and send browser cookies.T1547.001 · Registry Run Keys / Startup FolderWhen configured, SnappyClient can establish persistence using the Software\Microsoft\Windows\CurrentVersion\Run autorun key.T1548.002 · Bypass User Account ControlSnappyClient can bypass UAC using the CMSTPLUA COM interface and an elevation moniker.T1555.003 · Credentials from Web BrowsersSnappyClient has a command to collect and send saved browser passwords.T1560.002 · Archive via LibrarySnappyClient can archive specified files using the 7-Zip library, with an optional archive password.T1562.001 · Disable or Modify ToolsSnappyClient hooks AmsiScanBuffer and AmsiScanString to return AMSI_RESULT_CLEAN.T1573.001 · Symmetric CryptographySnappyClient encrypts C2 messages using ChaCha20-Poly1305.
Malware
GHOSTPULSEIn early February, ThreatLabz observed an X (formerly Twitter) post by @Kostastsale describing a GhostPulse/HijackLoader intrusion via ClickFix, with SnappyClient delivered as the payload.HIJACKLOADERcommand-and-control (C2) framework implant that we track as SnappyClient, which was delivered using HijackLoader. SnappyClient has an extended list of capabilities including taking screenshots, keylogging, a remoteSnappyClient2025, Zscaler ThreatLabz identified a new command-and-control (C2) framework implant that we track as SnappyClient, which was delivered using HijackLoader. SnappyClient has an extended list of capabilities including
Vendors
Products
360BrowserBrowsers: 360Browser, Opera, Chrome, CocCoc, Edge, Firefox, Slimjet, Vivaldi, Waterfox, and Brave.AtomicIf the window title matches the regex (binance|coinbase|exodus \d{1,2}\.|atomic wallet), perform action 384 (takes a screenshot and sends it to the C2). BitcoinCoreOther applications: Atomic, BitcoinCore, Coinomi, Electrum, Exodus, LedgerLive, TrezorSuite, and Wasabi.BraveBrowsers: 360Browser, Opera, Chrome, CocCoc, Edge, Firefox, Slimjet, Vivaldi, Waterfox, and Brave.CocCocBrowsers: 360Browser, Opera, Chrome, CocCoc, Edge, Firefox, Slimjet, Vivaldi, Waterfox, and Brave.CoinbaseIf the window title matches the regex (binance|coinbase|exodus \d{1,2}\.|atomic wallet), perform action 384 (takes a screenshot and sends it to the C2). CoinomiOther applications: Atomic, BitcoinCore, Coinomi, Electrum, Exodus, LedgerLive, TrezorSuite, and Wasabi.EdgeBrowsers: 360Browser, Opera, Chrome, CocCoc, Edge, Firefox, Slimjet, Vivaldi, Waterfox, and Brave.ElectrumOther applications: Atomic, BitcoinCore, Coinomi, Electrum, Exodus, LedgerLive, TrezorSuite, and Wasabi.ExodusIf the window title matches the regex (binance|coinbase|exodus \d{1,2}\.|atomic wallet), perform action 384 (takes a screenshot and sends it to the C2). Google ChromeBrowsers: 360Browser, Opera, Chrome, CocCoc, Edge, Firefox, Slimjet, Vivaldi, Waterfox, and Brave.LedgerLiveOther applications: Atomic, BitcoinCore, Coinomi, Electrum, Exodus, LedgerLive, TrezorSuite, and Wasabi.MetaMaskExtensions: Coinbase, Metamask, Phantom, TronLink, and TrustWallet.Microsoft Windowsthe current process path. For registry persistence, SnappyClient uses the autorun key Software\Microsoft\Windows\CurrentVersion\Run.Mozilla FirefoxBrowsers: 360Browser, Opera, Chrome, CocCoc, Edge, Firefox, Slimjet, Vivaldi, Waterfox, and Brave.OperaBrowsers: 360Browser, Opera, Chrome, CocCoc, Edge, Firefox, Slimjet, Vivaldi, Waterfox, and Brave.PhantomExtensions: Coinbase, Metamask, Phantom, TronLink, and TrustWallet.SlimjetBrowsers: 360Browser, Opera, Chrome, CocCoc, Edge, Firefox, Slimjet, Vivaldi, Waterfox, and Brave.TrezorSuiteOther applications: Atomic, BitcoinCore, Coinomi, Electrum, Exodus, LedgerLive, TrezorSuite, and Wasabi.TronLinkExtensions: Coinbase, Metamask, Phantom, TronLink, and TrustWallet.TrustWalletExtensions: Coinbase, Metamask, Phantom, TronLink, and TrustWallet.VivaldiBrowsers: 360Browser, Opera, Chrome, CocCoc, Edge, Firefox, Slimjet, Vivaldi, Waterfox, and Brave.WasabiOther applications: Atomic, BitcoinCore, Coinomi, Electrum, Exodus, LedgerLive, TrezorSuite, and Wasabi.WaterfoxBrowsers: 360Browser, Opera, Chrome, CocCoc, Edge, Firefox, Slimjet, Vivaldi, Waterfox, and Brave.
Industries
Cryptocurrencydecrypted the malware’s network communications. The activity indicates a financial motive, with cryptocurrency theft as the primary goal. Below is a list of events and software the malware registers.financeTelecommunicationsThe attack started with a website that impersonated a telecommunications company and targeted German-speaking users. The page lists product features and branding details. When a victim visits the page, a HijackLoader