# SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe)

> AhnLab ASEC reports phishing emails disguised as quote review requests from a Purchasing Department representative, carrying a compressed attachment with a JavaScript file. The JS runs an obfuscated PowerShell chain (AES-256-CBC, XOR-decrypted loader) that process-hollows aspnet_compiler.exe to run SnakeKeylogger, which steals browser data, system information and keystrokes and exfiltrates via SMTP or Telegram.

- **Published:** 2026-11-12T06:58:37Z
- **Last reviewed:** 2026-11-12T06:58:37Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5833
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5833.png
- **ID:** TL-2026-5833
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (3 shown free below)

## Description

AhnLab Security Intelligence Center (ASEC) published on 2026-11-12 an analysis of a phishing campaign that impersonates a representative of the Materials Management Division of a Purchasing Department and asks the recipient to review a quotation by downloading a compressed attachment. The archive contains a JavaScript file. When executed, the script decrypts and runs an obfuscated PowerShell script embedded within it.

The execution chain is multi-stage and fileless after the first script. The first PowerShell stage decrypts an embedded payload using AES-256-CBC and runs it in memory; that payload is a second PowerShell script. The second script decrypts an internal payload using an XOR operation (ASEC lists the XOR key THeSaTaN56@@^) and runs it in memory, passing two arguments: the path to aspnet_compiler.exe (the injection target) and the final malware payload. The in-memory loader launches aspnet_compiler.exe, a legitimate Microsoft .NET Framework build utility, and uses process hollowing to inject the final payload into it. ASEC does not publish the AES key or IV.

The final payload is SnakeKeylogger, a commodity infostealer. It collects browser-stored data, system information and keystrokes, and sends them out over SMTP or Telegram. In this sample ASEC reports an SMTP exfiltration configuration using the mail server hosting2.ro.hostsailor.com with sender account logs@aewn.buzz and recipient log@aewn.buzz (published defanged in the source; recorded here with real values). The article text does not state attachment names, persistence mechanisms, IP addresses, Telegram bot details, or additional hashes, and no CVE, actor attribution or affected-product versions are given; severity is analyst-assigned. ASEC's guidance: verify sender domains, inspect links before clicking, and treat .exe, .vbs and .js attachments with suspicion.

Context from prior public reporting on the family (not asserted for this specific sample): Fortinet documented an Excel-lure Snake Keylogger variant in August 2024 and an AutoIt-compiled variant in February 2025 (reported by Kevin Su of FortiGuard Labs) that hollows a legitimate .NET process (regsvcs.exe), copies itself to ageless.exe under %LocalAppData%\supergroup and drops ageless.vbs into the Startup folder for persistence, uses a WH_KEYBOARD_LL hook via SetWindowsHookEx for keylogging, steals Chrome/Edge/Firefox data and clipboard contents, checks victim IP via checkip.dyndns.org, and exfiltrates via SMTP and Telegram bots. That variant was reported to target users in China, Turkey, Indonesia, Taiwan and Spain, with over 280 million blocked infection attempts worldwide since the start of 2025.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1055.012 Process Hollowing
- T1547.001 Registry Run Keys / Startup Folder
- T1555.003 Credentials from Web Browsers
- T1056.001 Keylogging
- T1056.001 Keylogging
- T1082 System Information Discovery
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1567 Exfiltration Over Web Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SnakeKeylogger Process Hollowing of aspnet_compiler.exe and Stealer Module Loads — Post-Exploitation (TL-2026-5833)** (`TL-2026-5833-SPL-002`)

Detects the SnakeKeylogger injection and stealer stage: the in-memory PowerShell loader launches the legitimate .NET utility aspnet_compiler.exe (family variants use regsvcs.exe/regasm.exe) and hollows it to run the final payload. Combines script-host parentage, Sysmon ProcessTampering (EventCode 25), CreateRemoteThread (EventCode 8), the ASEC-published MD5 e89c8668c8b5041768a59c1532edf2ad, and image loads of System.Windows.Forms (keyboard hook/clipboard), System.Net.Mail (SMTP exfil) and SQLite (browser database parsing) into these utilities, which never legitimately need them.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1055.012, T1620, T1059.001, T1056.001, T1115, T1555.003
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents, DeviceEvents, DeviceImageLoadEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
((EventCode=1 (Image="*\\aspnet_compiler.exe" OR Image="*\\regsvcs.exe" OR Image="*\\regasm.exe") (ParentImage="*\\powershell.exe" OR ParentImage="*\\pwsh.exe" OR ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe" OR ParentImage="*\\mshta.exe"))
 OR (EventCode=25 (Image="*\\aspnet_compiler.exe" OR Image="*\\regsvcs.exe" OR Image="*\\regasm.exe"))
 OR (EventCode=8 (TargetImage="*\\aspnet_compiler.exe" OR TargetImage="*\\regsvcs.exe" OR TargetImage="*\\regasm.exe"))
 OR (EventCode=7 (Image="*\\aspnet_compiler.exe" OR Image="*\\regsvcs.exe" OR Image="*\\regasm.exe") (ImageLoaded="*\\System.Windows.Forms*.dll" OR ImageLoaded="*\\System.Net.Mail*.dll" OR ImageLoaded="*\\System.Data.SQLite*.dll" OR ImageLoaded="*\\sqlite3.dll"))
 OR ((EventCode=1 OR EventCode=7) Hashes="*MD5=E89C8668C8B5041768A59C1532EDF2AD*"))
| eval target=coalesce(TargetImage, Image)
| eval signal=case(like(upper(Hashes),"%MD5=E89C8668C8B5041768A59C1532EDF2AD%"),"known_snakekeylogger_md5",EventCode=1,"script_host_spawned_dotnet_lolbin",EventCode=25,"process_tampering",EventCode=8,"remote_thread_into_dotnet_lolbin",EventCode=7,"stealer_module_loaded_by_dotnet_lolbin")
| stats count min(_time) as firstTime max(_time) as lastTime values(signal) as signals values(ParentImage) as parents values(SourceImage) as injectors values(ImageLoaded) as modules by host target
| convert ctime(firstTime) ctime(lastTime)
```

### Microsoft KQL

```kql
let targets = dynamic(["aspnet_compiler.exe", "regsvcs.exe", "regasm.exe"]);
let spawn = DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ (targets)
    | where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe")
    | project Timestamp, DeviceName, Signal = "script_host_spawned_dotnet_lolbin", FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
let inject = DeviceEvents
    | where Timestamp > ago(24h)
    | where ActionType in ("CreateRemoteThreadApiCall", "NtAllocateVirtualMemoryRemoteApiCall", "NtMapViewOfSectionRemoteApiCall", "QueueUserApcRemoteApiCall", "SetThreadContextRemoteApiCall")
    | where FileName in~ (targets)
    | project Timestamp, DeviceName, Signal = strcat("remote_injection_", ActionType), FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
let modules = DeviceImageLoadEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessFileName in~ (targets)
    | where FileName matches regex @"(?i)^(System\.Windows\.Forms.*|System\.Net\.Mail.*|System\.Data\.SQLite.*|sqlite3)\.dll$"
    | project Timestamp, DeviceName, Signal = "stealer_module_loaded_by_dotnet_lolbin", FileName, ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
let knownhash = DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where MD5 =~ "e89c8668c8b5041768a59c1532edf2ad"
    | project Timestamp, DeviceName, Signal = "known_snakekeylogger_md5", FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
union spawn, inject, modules, knownhash
| order by Timestamp desc
```

### Sigma

```yaml
title: SnakeKeylogger Process Hollowing Target aspnet_compiler.exe Spawned by Script Host
id: 2e9f6b18-c4d7-4a35-8e60-1f7a3d52b9c8
status: experimental
description: Detects aspnet_compiler.exe, regsvcs.exe or regasm.exe started by PowerShell or a script host, the hollowing target used by the SnakeKeylogger loader (TL-2026-5833). Tampering, remote-thread, stealer-module-load and hash signals are covered in the SPL and KQL forms.
references:
    - https://asec.ahnlab.com/en/96495/
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.defense-evasion
    - attack.t1055.012
    - attack.t1620
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|endswith:
            - '\aspnet_compiler.exe'
            - '\regsvcs.exe'
            - '\regasm.exe'
    selection_parent:
        ParentImage|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
    selection_hash:
        Hashes|contains: 'MD5=E89C8668C8B5041768A59C1532EDF2AD'
    condition: (selection_image and selection_parent) or selection_hash
falsepositives:
    - Developers invoking regasm.exe or regsvcs.exe from PowerShell build scripts
    - ASP.NET precompilation run from PowerShell deployment pipelines
level: high

```

**Known false positives:**

- Build or deployment scripts that call aspnet_compiler.exe or regasm.exe from PowerShell
- Developer workstations registering .NET assemblies via regsvcs.exe

**Tuning notes:** Allow-list build servers and CI service accounts. aspnet_compiler.exe normally runs with -v/-p arguments, so spawns with empty command lines are higher fidelity. EventCode 25 requires Sysmon 13+ with ProcessTampering enabled; EventCode 7 requires ImageLoad logging for these three binaries (scope the Sysmon config to them to limit volume). The module-load leg (System.Windows.Forms -> keyboard hook/clipboard, SQLite -> browser DB parsing, System.Net.Mail -> SMTP) is behavioural and family-level; the Sigma form covers spawn parentage and the MD5 only.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SnakeKeylogger Quote-Lure .js Attachment Executed from Archive Path — Exploitation (TL-2026-5833) (locked: unlock with TL Creds)
- SnakeKeylogger Startup/Run-Key Persistence and ageless Artifacts — Post-Exploitation (TL-2026-5833) (locked: unlock with TL Creds)
- SnakeKeylogger SMTP/Telegram Exfil Infrastructure [indicator] / [indicator] — C2/Exfil (TL-2026-5833) (locked: unlock with TL Creds)
- SnakeKeylogger Fileless PowerShell AES/XOR Loader — Exploitation (TL-2026-5833) (locked: unlock with TL Creds)
- SnakeKeylogger Browser Credential Store Theft by Non-Browser or Hollowed .NET Process — Post-Exploitation (TL-2026-5833) (locked: unlock with TL Creds)
- SnakeKeylogger SMTP/Telegram Exfiltration from Non-Mail or Hollowed Process — C2/Exfil (TL-2026-5833) (locked: unlock with TL Creds)
- SnakeKeylogger JS-to-PowerShell Decrypt Chain — Exploitation (TL-2026-5833) (locked: unlock with TL Creds)
- SnakeKeylogger Telegram Exfiltration and IP Lookup from .NET LOLBin — C2/Exfil (TL-2026-5833) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 13)

Defanged, TLP:CLEAR.

- Domain: `hostsailor[.]com`
- File hash: `e89c8668c8b5041768a59c1532edf2ad`
- Domain: `aewn[.]buzz`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ASEC: Beware of phishing emails disguised as quote requests (SnakeKeylogger)](https://asec.ahnlab.com/en/96495/)
- [The Hacker News: New Snake Keylogger Variant Leverages AutoIt Scripting to Evade Detection](https://thehackernews.com/2025/02/new-snake-keylogger-variant-leverages.html)
- [RH-ISAC: New Snake Keylogger Variant Leverages New Scripting Tools to Evade Detection](https://rhisac.org/threat-intelligence/new-snake-keylogger/)
- [FortiGuard Labs: Deep Analysis of Snake Keylogger's New Variant](https://feeds.fortinet.com/~/903638177/0/fortinet/blogs~Deep-Analysis-of-Snake-Keylogger%e2%80%99s-New-Variant)
- [Securitricks: Deep Analysis of Snake Keylogger's New Variant (Fortinet report mirror)](https://securitricks.com/attackreports/deep-analysis-of-snake-keyloggers-new-variant)
- [Gurucul Threat Research: Deep Analysis of Snake Keylogger's New Variant](https://community.gurucul.com/articles/ThreatResearch/Deep-Analysis-of-Snake-Keylogger-s-New-29-8-2024)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5833