SnappyClient is a newly identified C++ command-and-control (C2) framework implant discovered by Zscaler ThreatLabz during incident response investigations. The malware has been tracked across five versions (0.1.5 through 0.1.11) and demonstrates rapid iterative development by its operators.

## Delivery Chains

SnappyClient is exclusively delivered through HijackLoader (also known as IDAT Loader), with two confirmed delivery vectors:

1. **HijackLoader via Phishing Sites (December 2025):** Threat actors created phishing sites impersonating legitimate companies such as Telefonica O2, specifically targeting German-speaking users. Victims download HijackLoader executables that decrypt and deploy the SnappyClient payload.

2. **ClickFix/GhostPulse Social Engineering (February 2026):** A secondary delivery mechanism documented via security researcher @Kostastsale on X, where ClickFix social engineering tricks users into executing commands that ultimately load HijackLoader, which then delivers SnappyClient.

Code-level similarities between HijackLoader and SnappyClient — including matching API structure layouts, identical direct-syscall population routines, and parallel transacted-hollowing implementations — strongly suggest shared developer ownership.

## Implant Architecture

SnappyClient operates on a dual-session TCP architecture: - **Control Session (port 3333):** Single persistent connection for registration, heartbeats, and command receipt - **Data Sessions (port 3334):** Multiple concurrent connections for file transfers, credential exfiltration, and bulk data upload

All communications are encrypted with ChaCha20-Poly1305 and compressed using the Snappy compression algorithm (from which the malware derives its name). The protocol uses a structured message header with command IDs (2 bytes), Mersenne Twister-generated message IDs (4 bytes), and plaintext length indicators.

## Evasion Capabilities

SnappyClient employs multiple defense evasion techniques: - **AMSI Bypass:** Hooks LoadLibraryExW to intercept amsi.dll loading, then patches AmsiScanBuffer and AmsiScanString to always return AMSI_RESULT_CLEAN - **Heaven's Gate:** 32-bit to 64-bit execution context transitions for direct system calls, bypassing userland API hooks - **Transacted Hollowing:** Advanced process injection technique combining transacted sections with process doppelganging and DLL hollowing - **App-Bound Encryption Bypass:** Uses transacted hollowing to inject into trusted browser processes and retrieve AES-256 master keys for Chrome cookie/credential decryption

## Configuration System

The implant uses three encrypted configuration databases: - **Main Config (JSON-embedded):** Contains build ID, installation directory, persistence settings, mutex name, and version enforcement via shared memory - **EventsDB (ChaCha20 encrypted, magic 0xCEDD9AB7):** Conditional action triggers based on clipboard regex patterns and window titles — actions include clipboard replacement, screenshot capture, and HTTP-based clipboard exfiltration - **SoftwareDB (ChaCha20 encrypted, magic 0x7FCBB9E9):** Target application definitions for data theft operations

Network configuration decryption involves a multi-stage pipeline: ChaCha20-Poly1305, SHA1/SHA256, modified RIPEMD-160, Snappy decompression, Base58 decoding, and embedded 7-Zip archive extraction.

## Data Theft Capabilities

SnappyClient targets an extensive range of applications: - **Browsers (10+):** Chrome, Firefox, Edge, Brave, Opera, and others — extracting passwords, cookies, browsing history, and extension data - **Cryptocurrency Wallet Extensions (5):** Coinbase Wallet, MetaMask, Phantom, TronLink, TrustWallet - **Cryptocurrency Desktop Applications (8):** Atomic Wallet, Bitcoin Core, Coinomi, Electrum, Exodus, Ledger Live, Trezor Suite, Wasabi Wallet - **Clipboard Monitoring:** Real-time Ethereum address detection (regex: ^0x[a-fA-F0-9]{40}$) for clipboard replacement attacks

## Command Set

The C2 protocol supports a rich command set identified by hex command IDs: - 0xFFFF: Registration with victim metadata (volume serial, CPU signature, computer/user name) - 0xCCCE: Screenshots, process management, file operations, keylogger exfiltration, browser credential theft, VNC browser, remote file browser, remote shell - 0xCCCC: Reverse proxy setup (FTP/VNC/RLOGIN/SOCKS5) - 0xDDDD: Data session lifecycle control - 0xDCCA: File/folder transmission, keylogger upload - 0xDACC: Multi-browser credential stealing, file download, file search - 0xDADA: Download job management - 0xEECC: EventsDB/SoftwareDB synchronization - 0xACCC: Exit and device ban (SHA-1 hash of VolumeSerialNumber:BANNED) - 0xADBB: MessageBox/IWebBrowser window creation, network config updates

## Persistence

SnappyClient establishes persistence through two mechanisms: 1. Scheduled task creation with a logon trigger 2. Registry Run key installation at HKCU\Software\Microsoft\Windows\CurrentVersion\Run

The implant self-replicates to a configured installation directory and uses a named shared memory object (FNV-1a hash of reversed COMPUTERNAME+USERNAME XOR length) for version enforcement across instances.

## System Fingerprinting

Victim identification is computed from: volume serial number + CPU signature (CPUID EAX=1) + computer name + username, creating a unique device identifier used for C2 session management and device banning.