Signed Light Alloy Installer Lure Delivers SnappyClient Crypto-Stealing RAT

Oct 11, 2026 · Original article ↗

Summary

Analysis of a signed Light Alloy installer lure found SnappyClient 0.1.31, which targets crypto wallets, recovery phrases, Telegram sessions and browser data. Researchers decrypted its C2 traffic and identified new capabilities in the malware.

Key points

The file posed as Light Alloy but was an Inno Setup engine with hidden malicious code; it installed no media player.
The malware used a loader and process hollowing to run SnappyClient 0.1.31 inside dllhost.exe.
Decrypted server traffic showed automatic jobs targeting wallet data, Telegram sessions, recovery phrases, and passwords, cookies, and wallet extensions across 14 browsers.
The sandbox contained no real wallet or browser data, so the analysis found no valuable information taken.
Researchers found code for a Windows-like credential prompt that validates typed passwords, plus commands to pause or cancel theft jobs and interact with windows.
The server answered on 24 September 2026 and was silent by 30 September; the article says the delivery route was initially unknown.
GTIG and Mandiant later reported finding the same file, named Ple64.exe, uploaded through web shells on Oracle PeopleSoft servers they said UNC6240 had compromised.

Article Details

Attack Vectors: A malicious Inno Setup engine posing as Light Alloy used a valid EV certificate from a company with no apparent connection to the product. Hidden code in the installer redirected execution before any window appeared.
The loader decrypted stages in memory, used Heaven’s Gate to cross from 32-bit to 64-bit execution, and process-hollowed dllhost.exe to run SnappyClient without writing the malicious payload to disk.
GTIG and Mandiant reportedly found the same SHA256 file, named Ple64.exe, uploaded through web shells to Oracle PeopleSoft servers they say UNC6240 had compromised through CVE-2026-35273. The article says how the LA.exe sample reached victims was initially unknown.
Defensive Notes: Download software from the developer’s official website and verify that the signer matches the product’s actual developer; a valid signature alone does not establish that a file is safe.
Treat an installer that appears to do nothing as suspicious, and cancel unexpected Windows credential prompts.
Hunt for C:\Windows\SysWOW64\dllhost.exe launched without command-line arguments by an unusual parent that exits immediately afterward, including LA.exe’s reported exit code 0x13377331.
Block and hunt for connections to 162[.]219[.]30[.]165 on ports 3333 and 3334, and look for a Lanus folder under C:\ProgramData.
Do not keep cryptocurrency recovery phrases in text files, screenshots, or notes on a computer.

Indicators of compromise

Type	Indicator	Context
IPV4	`162[.]219[.]30[.]165`	SnappyClient command-and-control server; control and data channels use ports 3333 and 3334.
MD5	`ba0ec19a36d0e08979ae38a2c8977a9c`	MD5 of the malicious LA.exe installer posing as Light Alloy.
SHA256	`3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b`	SHA256 of the x64 App-Bound helper module reconstructed from SnappyClient code.
SHA256	`3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3`	SHA256 of the malicious LA.exe installer posing as Light Alloy.
SHA256	`fb56e66920c84ef9e51db0ea23144f5755daef97cbff8613b05ab56d0dc9d623`	SHA256 of the x86 App-Bound helper module reconstructed from SnappyClient code.