SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5833 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SnakeKeylogger Process Hollowing of aspnet_compiler.exe and Stealer Module Loads — Post-Exploitation (TL-2026-5833)

Detects the SnakeKeylogger injection and stealer stage: the in-memory PowerShell loader launches the legitimate .NET utility aspnet_compiler.exe (family variants use regsvcs.exe/regasm.exe) and hollows it to run the final payload. Combines script-host parentage, Sysmon ProcessTampering (EventCode 25), CreateRemoteThread (EventCode 8), the ASEC-published MD5 e89c8668c8b5041768a59c1532edf2ad, and image loads of System.Windows.Forms (keyboard hook/clipboard), System.Net.Mail (SMTP exfil) and SQLite (browser database parsing) into these utilities, which never legitimately need them.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1055.012, T1620, T1059.001, T1056.001, T1115, T1555.003
• Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents, DeviceEvents, DeviceImageLoadEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
((EventCode=1 (Image="*\\aspnet_compiler.exe" OR Image="*\\regsvcs.exe" OR Image="*\\regasm.exe") (ParentImage="*\\powershell.exe" OR ParentImage="*\\pwsh.exe" OR ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe" OR ParentImage="*\\mshta.exe"))
 OR (EventCode=25 (Image="*\\aspnet_compiler.exe" OR Image="*\\regsvcs.exe" OR Image="*\\regasm.exe"))
 OR (EventCode=8 (TargetImage="*\\aspnet_compiler.exe" OR TargetImage="*\\regsvcs.exe" OR TargetImage="*\\regasm.exe"))
 OR (EventCode=7 (Image="*\\aspnet_compiler.exe" OR Image="*\\regsvcs.exe" OR Image="*\\regasm.exe") (ImageLoaded="*\\System.Windows.Forms*.dll" OR ImageLoaded="*\\System.Net.Mail*.dll" OR ImageLoaded="*\\System.Data.SQLite*.dll" OR ImageLoaded="*\\sqlite3.dll"))
 OR ((EventCode=1 OR EventCode=7) Hashes="*MD5=E89C8668C8B5041768A59C1532EDF2AD*"))
| eval target=coalesce(TargetImage, Image)
| eval signal=case(like(upper(Hashes),"%MD5=E89C8668C8B5041768A59C1532EDF2AD%"),"known_snakekeylogger_md5",EventCode=1,"script_host_spawned_dotnet_lolbin",EventCode=25,"process_tampering",EventCode=8,"remote_thread_into_dotnet_lolbin",EventCode=7,"stealer_module_loaded_by_dotnet_lolbin")
| stats count min(_time) as firstTime max(_time) as lastTime values(signal) as signals values(ParentImage) as parents values(SourceImage) as injectors values(ImageLoaded) as modules by host target
| convert ctime(firstTime) ctime(lastTime)

Microsoft KQL

let targets = dynamic(["aspnet_compiler.exe", "regsvcs.exe", "regasm.exe"]);
let spawn = DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ (targets)
    | where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe")
    | project Timestamp, DeviceName, Signal = "script_host_spawned_dotnet_lolbin", FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
let inject = DeviceEvents
    | where Timestamp > ago(24h)
    | where ActionType in ("CreateRemoteThreadApiCall", "NtAllocateVirtualMemoryRemoteApiCall", "NtMapViewOfSectionRemoteApiCall", "QueueUserApcRemoteApiCall", "SetThreadContextRemoteApiCall")
    | where FileName in~ (targets)
    | project Timestamp, DeviceName, Signal = strcat("remote_injection_", ActionType), FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
let modules = DeviceImageLoadEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessFileName in~ (targets)
    | where FileName matches regex @"(?i)^(System\.Windows\.Forms.*|System\.Net\.Mail.*|System\.Data\.SQLite.*|sqlite3)\.dll$"
    | project Timestamp, DeviceName, Signal = "stealer_module_loaded_by_dotnet_lolbin", FileName, ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
let knownhash = DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where MD5 =~ "e89c8668c8b5041768a59c1532edf2ad"
    | project Timestamp, DeviceName, Signal = "known_snakekeylogger_md5", FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
union spawn, inject, modules, knownhash
| order by Timestamp desc

Sigma

title: SnakeKeylogger Process Hollowing Target aspnet_compiler.exe Spawned by Script Host
id: 2e9f6b18-c4d7-4a35-8e60-1f7a3d52b9c8
status: experimental
description: Detects aspnet_compiler.exe, regsvcs.exe or regasm.exe started by PowerShell or a script host, the hollowing target used by the SnakeKeylogger loader (TL-2026-5833). Tampering, remote-thread, stealer-module-load and hash signals are covered in the SPL and KQL forms.
references:
    - https://asec.ahnlab.com/en/96495/
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.defense-evasion
    - attack.t1055.012
    - attack.t1620
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|endswith:
            - '\aspnet_compiler.exe'
            - '\regsvcs.exe'
            - '\regasm.exe'
    selection_parent:
        ParentImage|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
    selection_hash:
        Hashes|contains: 'MD5=E89C8668C8B5041768A59C1532EDF2AD'
    condition: (selection_image and selection_parent) or selection_hash
falsepositives:
    - Developers invoking regasm.exe or regsvcs.exe from PowerShell build scripts
    - ASP.NET precompilation run from PowerShell deployment pipelines
level: high

Known false positives:

• Build or deployment scripts that call aspnet_compiler.exe or regasm.exe from PowerShell
• Developer workstations registering .NET assemblies via regsvcs.exe

Tuning notes: Allow-list build servers and CI service accounts. aspnet_compiler.exe normally runs with -v/-p arguments, so spawns with empty command lines are higher fidelity. EventCode 25 requires Sysmon 13+ with ProcessTampering enabled; EventCode 7 requires ImageLoad logging for these three binaries (scope the Sysmon config to them to limit volume). The module-load leg (System.Windows.Forms -> keyboard hook/clipboard, SQLite -> browser DB parsing, System.Net.Mail -> SMTP) is behavioural and family-level; the Sigma form covers spawn parentage and the MD5 only.

• 🔒 SnakeKeylogger Quote-Lure .js Attachment Executed from Archive Path — Exploitation (TL-2026-5833) · unlock with TL Creds
• 🔒 SnakeKeylogger Startup/Run-Key Persistence and ageless Artifacts — Post-Exploitation (TL-2026-5833) · unlock with TL Creds
• 🔒 SnakeKeylogger SMTP/Telegram Exfil Infrastructure [indicator] / [indicator] — C2/Exfil (TL-2026-5833) · unlock with TL Creds
• 🔒 SnakeKeylogger Fileless PowerShell AES/XOR Loader — Exploitation (TL-2026-5833) · unlock with TL Creds
• 🔒 SnakeKeylogger Browser Credential Store Theft by Non-Browser or Hollowed .NET Process — Post-Exploitation (TL-2026-5833) · unlock with TL Creds
• 🔒 SnakeKeylogger SMTP/Telegram Exfiltration from Non-Mail or Hollowed Process — C2/Exfil (TL-2026-5833) · unlock with TL Creds
• 🔒 SnakeKeylogger JS-to-PowerShell Decrypt Chain — Exploitation (TL-2026-5833) · unlock with TL Creds
• 🔒 SnakeKeylogger Telegram Exfiltration and IP Lookup from .NET LOLBin — C2/Exfil (TL-2026-5833) · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5833.

Sample indicators (3 of 13)

• Domain: hostsailor[.]com
• File hash: e89c8668c8b5041768a59c1532edf2ad
• Domain: aewn[.]buzz

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

Community OSINT corroboration

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

AhnLab Security Intelligence Center (ASEC) published on 2026-11-12 an analysis of a phishing campaign that impersonates a representative of the Materials Management Division of a Purchasing Department and asks the recipient to review a quotation by downloading a compressed attachment. The archive contains a JavaScript file. When executed, the script decrypts and runs an obfuscated PowerShell script embedded within it.

The execution chain is multi-stage and fileless after the first script. The first PowerShell stage decrypts an embedded payload using AES-256-CBC and runs it in memory; that payload is a second PowerShell script. The second script decrypts an internal payload using an XOR operation (ASEC lists the XOR key THeSaTaN56@@^) and runs it in memory, passing two arguments: the path to aspnet_compiler.exe (the injection target) and the final malware payload. The in-memory loader launches aspnet_compiler.exe, a legitimate Microsoft .NET Framework build utility, and uses process hollowing to inject the final payload into it. ASEC does not publish the AES key or IV.

The final payload is SnakeKeylogger, a commodity infostealer. It collects browser-stored data, system information and keystrokes, and sends them out over SMTP or Telegram. In this sample ASEC reports an SMTP exfiltration configuration using the mail server hosting2.ro.hostsailor.com with sender account logs@aewn.buzz and recipient log@aewn.buzz (published defanged in the source; recorded here with real values). The article text does not state attachment names, persistence mechanisms, IP addresses, Telegram bot details, or additional hashes, and no CVE, actor attribution or affected-product versions are given; severity is analyst-assigned. ASEC's guidance: verify sender domains, inspect links before clicking, and treat .exe, .vbs and .js attachments with suspicion.

Context from prior public reporting on the family (not asserted for this specific sample): Fortinet documented an Excel-lure Snake Keylogger variant in August 2024 and an AutoIt-compiled variant in February 2025 (reported by Kevin Su of FortiGuard Labs) that hollows a legitimate .NET process (regsvcs.exe), copies itself to ageless.exe under %LocalAppData%\supergroup and drops ageless.vbs into the Startup folder for persistence, uses a WH_KEYBOARD_LL hook via SetWindowsHookEx for keylogging, steals Chrome/Edge/Firefox data and clipboard contents, checks victim IP via checkip.dyndns.org, and exfiltrates via SMTP and Telegram bots. That variant was reported to target users in China, Turkey, Indonesia, Taiwan and Spain, with over 280 million blocked infection attempts worldwide since the start of 2025.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Exfiltration

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol; T1567 Exfiltration Over Web Service

Credential Access

T1056.001 Keylogging; T1555.003 Credentials from Web Browsers

Collection

T1056.001 Keylogging

Execution

T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File

Discovery

T1082 System Information Discovery

Persistence

T1547.001 Registry Run Keys / Startup Folder

Initial Access

T1566.001 Spearphishing Attachment

Remediation

Immediate actions

• Block and search mail logs for the lure (quote-review requests with compressed attachments containing .js files)
• Block outbound SMTP to hosting2.ro.hostsailor.com and mail to/from logs@aewn.buzz and log@aewn.buzz; block aewn.buzz
• Hunt for MD5 e89c8668c8b5041768a59c1532edf2ad and for aspnet_compiler.exe spawned by powershell.exe or with unusual parentage/network activity
• Reset credentials stored in browsers on any affected host and revoke active sessions

Workarounds

• Use WDAC/AppLocker to prevent wscript.exe/cscript.exe execution of user-writable-path scripts
• Disable password saving in browsers via policy

Longer-term hardening

• Block or open-in-Notepad .js/.jse/.wsf files by default via file association hardening
• Restrict outbound SMTP from workstations to approved mail relays only
• Enable PowerShell Script Block and AMSI logging and deploy EDR with process-injection detection
• Quarantine archive attachments containing script files at the mail gateway

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows endpoints able to execute JavaScript (WSH) and PowerShell with .NET Framework installed

Timeline

• 2024-08-28 FortiGuard Labs publishes a deep analysis of a Snake Keylogger variant delivered via malicious Excel attachments with a loader that unpacks the keylogger.
• 2024-08-29 Gurucul Threat Research republishes the Fortinet deep analysis of the Snake Keylogger variant, extending defender awareness of the loader and exfiltration behaviors.
• 2025-02-19 Fortinet-sourced reporting documents the AutoIt variant copying itself to locked-ioc-9 in locked-ioc-3, dropping locked-ioc-8 in the Startup folder, hollowing regsvcs.exe, and targeting users in China, Turkey, Indonesia, Taiwan and Spain.
• 2025-02-19 The Hacker News and RH-ISAC report a new AutoIt-based Snake Keylogger variant (per Fortinet) that hollows a legitimate .NET process, with over 280 million blocked infection attempts since the start of 2025.
• 2026-11-12 ASEC releases IOCs: MD5 locked-ioc-1, SMTP host locked-ioc-2, sender locked-ioc-6, recipient locked-ioc-7, XOR key THeSaTaN56@@^.
• 2026-11-12 ASEC documents the chain: JavaScript -> obfuscated PowerShell -> AES-256-CBC decrypted in-memory PowerShell -> XOR-decrypted loader -> process hollowing into aspnet_compiler.exe -> SnakeKeylogger.
• 2026-11-12 AhnLab ASEC publishes analysis of quote-request phishing emails impersonating a Purchasing Department Materials Management Division representative, carrying a compressed JavaScript attachment.

Sources cited

• FortiGuard Labs: Deep Analysis of Snake Keylogger's New Variant Fortinet · Research · 2024-08-28
• Securitricks: Deep Analysis of Snake Keylogger's New Variant (Fortinet report mirror) securitricks.com · Research · 2024-08-28
• Gurucul Threat Research: Deep Analysis of Snake Keylogger's New Variant community.gurucul.com · Research · 2024-08-29
• ASEC: Beware of phishing emails disguised as quote requests (SnakeKeylogger) asec.ahnlab.com · Blog · 2026-11-12
• The Hacker News: New Snake Keylogger Variant Leverages AutoIt Scripting to Evade Detection The Hacker News · News · 2025-02-19
• RH-ISAC: New Snake Keylogger Variant Leverages New Scripting Tools to Evade Detection rhisac.org · News · 2025-02-19

More in malware

• SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension
• Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)
• eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)
• Falcon (XG / Xiàng Gē) Browser-Based C2 Framework and Antino Implant Targeting Government Webmail and Web Applications
• Qlik Sense Servers Targeted With PowerShell/Go Reverse Shells; ActiveMQ (CVE-2023-46604) and Veeam (CVE-2024-40711) Exploits Staged