SnappyClient

Victims usually meet a ClickFix prompt through phishing, malicious ads, or compromised websites.

Group-IB observed SilabRAT spreading through email spam and ClickFix social engineering. Victims usually meet a ClickFix prompt through phishing, malicious ads, or compromised websites.

the same sample had also been distributed via a targeted spear-phishing campaign against a small number of German financial institutions

In one SnappyClient campaign Zscaler observed, the attack began with a very convincing looking website impersonating Spanish telecommunications company Telefonica.

a scheduled task at C:\Windows\Tasks\socket_dispatcher_v2.job

It can also escalate privileges through a known UAC bypass and set up persistence via registry keys or scheduled tasks.

a user was tricked into running a malicious PowerShell command

The Blackpoint SOC received alerts for suspicious powershell.exe usage by a user who fell for a ClickFix-style (Win+R) attack.

Attackers can use the implant to establish a remote shell on compromised systems for direct command-line access.

“Both the loader and HijackLoader build their syscall table the same way: read ntdll.dll from disk, walk the export directory, keep every export whose name begins with Zw, and pull the service number out of the function body.”

a user was tricked into running a malicious PowerShell command | The Blackpoint SOC responded to a ClickFix-style (Win+R) attack in which a user was tricked into running a malicious PowerShell command.

Group-IB observed SilabRAT spreading through email spam and ClickFix social engineering.

a scheduled task at C:\Windows\Tasks\socket_dispatcher_v2.job

It can also escalate privileges through a known UAC bypass and set up persistence via registry keys or scheduled tasks.

It can also escalate privileges through a known UAC bypass and set up persistence via registry keys or scheduled tasks.

a logon Startup shortcut at \Startup\prompt_analyzer_debug.lnk

a scheduled task at C:\Windows\Tasks\socket_dispatcher_v2.job

It can also escalate privileges through a known UAC bypass and set up persistence via registry keys or scheduled tasks.

Its author has teased plans to inject code into Electron-based apps, including the Ledger and Trezor wallet managers.

“The loader marks its own image writable, zeroes it and then calls into the function that is responsible for mapping the final payload in its place. From this point on the process is executing out of memory it has just erased.”

It can also escalate privileges through a known UAC bypass and set up persistence via registry keys or scheduled tasks.

a logon Startup shortcut at \Startup\prompt_analyzer_debug.lnk

It can also escalate privileges through a known UAC bypass and set up persistence via registry keys or scheduled tasks.

“The .xyz section [is] LZMA compressed - SnappyClient” and “.data [is] LZMA compressed - Module table.”

“The same API resolution order” and “a fresh copy of ntdll.dll is mapped from disk and a second batch of functions is resolved from it.”

the archive drops a genuine, signed copy of Radmin VPN simply renamed

Its author has teased plans to inject code into Electron-based apps, including the Ledger and Trezor wallet managers.

“The loader marks its own image writable, zeroes it and then calls into the function that is responsible for mapping the final payload in its place. From this point on the process is executing out of memory it has just erased.”

“Both are decompressed by the same function” and the loader “decompresses two sections.”

a trusted, signed program loads a malicious library from its own directory, so the attacker’s code ends up running inside a process that every reputation and signature check considers benign

“It decompresses two sections, maps one of them over its own image base, resolves imports, patches up the PEB, and transfers execution to the mapped image’s entry point.”

“Resolving them from a clean mapping means the pointers land in unmodified code rather than in whatever a security product has patched into the loaded image.”

From there, they can launch stealers, log keystrokes, watch the clipboard, or push more payloads.

The malware leans on session hijacking, too. As Group-IB explains, seizing an active session can bypass passwords and even multi-factor authentication.

An “AutoWallet” module runs in the background and tries to crack passwords on any cryptocurrency wallets it finds. It reuses passwords harvested from the victim’s browser to unlock encrypted wallets.

SilabRAT also tackles modern browser defenses. It bypasses Chrome’s App-Bound Encryption, a protection meant to lock browser secrets to the legitimate Chrome process.

Perhaps the most dangerous capability is Hidden Virtual Network Computing, or HVNC. Group-IB notes the technique lets an attacker “invisibly remotely control a compromised machine.”

From there, they can launch stealers, log keystrokes, watch the clipboard, or push more payloads.

It supports an extensive set of commands including the ability to take screenshots, log keystrokes, enable remote shell access, and steal data from applications, browsers, and extensions.

From there, they can launch stealers, log keystrokes, watch the clipboard, or push more payloads.

Subsequently, SnappyClient sends an encrypted packet with the message header, followed by another packet containing the encrypted and compressed message.

The malware communicates with its C&C server using a custom binary protocol. The traffic is encrypted with ChaCha20-Poly1305 using a key and nonce received from the server, which are exchanged and validated before any control commands are sent or received.

The malware communicates with its C&C server using a custom binary protocol.

The script pulled a disguised MSI installer from cloud storage

SnappyClient (Silab RAT), a RAT designed to provide persistent access to compromised environments.

The traffic is encrypted with ChaCha20-Poly1305 using a key and nonce received from the server, which are exchanged and validated before any control commands are sent or received.