🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9cfd9d7809db39171276e22315697300a26e672e3091d0a690bd1143b302837. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnappyClient


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9cfd9d7809db39171276e22315697300a26e672e3091d0a690bd1143b302837
SHA3-384 hash: cfef3a9117c6684c842ab4a9422f9512507db8f852a1376480c36c2521d4df42f4860212f9cfcd256b7069e1356d8e63
SHA1 hash: d758d8313a67cf5404dc237e814f6b269f4bd0ea
MD5 hash: 2432ea6d9bdfb550a8076a7724553dba
humanhash: five-ten-finch-princess
File name:b9cfd9d7809db391.bin
Download: download sample
Signature SnappyClient
Create hunting rule
File size:14'562'667 bytes
First seen:2026-11-02 12:23:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash b5a014d7eeb4c2042897567e1288a095 (25 x HijackLoader, 23 x GhostPulse, 21 x SnappyClient)
ssdeep 393216:+pvL/tIlrOleo4Otb9Zjs8F2EhizYq/ZJM35K:evLGM4Otb9Zjs8UE2JL
TLSH T10FE633823392E0E8D6715436DF09DB1A90F7C32565931B96D25B2D4B8E83DFB42873CA
TrID 42.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.8% (.EXE) Win64 Executable (generic) (6522/11/2)
13.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.6% (.EXE) Win32 Executable (generic) (4504/4/1)
5.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon c292ecd8f2f6fe1c (24 x HijackLoader, 23 x GhostPulse, 21 x SnappyClient)
Reporter Tuxxin
Tags:exe HIjackLoader SnappyClient

Intelligence

File Origin
# of uploads :
1
# of downloads :
197
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-02 12:42:28 UTC
Tags:
auto-startup hijackloader loader snappyclient rat stealer
Link:
https://app.any.run/tasks/db1b6091-7853-44ac-8e4b-c052fcd949bb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/96824/
Verdict:
Clean
Score:
N/A%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae880ed38ccdea12c56907d
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending a custom TCP request
Creating a file
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context adaptive-context fingerprint installer installer installer-heuristic masquerade microsoft_visual_cc overlay packed reconnaissance sfx
Link:
https://www.filescan.io/uploads/6ae880eabd48208795bfd747/reports/cc3f19d9-3956-491f-a60b-cd310b7f161f/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/b9cfd9d7809db39171276e22315697300a26e672e3091d0a690bd1143b302837
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-11-01T12:28:00Z UTC
Last seen:
2026-11-04T09:39:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/b9cfd9d7809db39171276e22315697300a26e672e3091d0a690bd1143b302837/results?tab=lookup
Malware family:
IDAT Loader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f009e14a-65c7-4dad-8f80-70218dcfd656
Result
Threat name:
SnappyClient
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1996562
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Contains VNC / remote desktop functionality (version string found)
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Uses the Windows Restart Manager Abuse for Browser Credential File unlocking
Yara detected SnappyClient
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1996562 Sample: b9cfd9d7809db391.bin.exe Startdate: 02/11/2026 Architecture: WINDOWS Score: 100 72 new-label.club 2->72 92 Found malware configuration 2->92 94 Antivirus detection for dropped file 2->94 96 Multi AV Scanner detection for submitted file 2->96 98 Yara detected SnappyClient 2->98 10 b9cfd9d7809db391.bin.exe 14 2->10         started        13 chrome.exe 2->13         started        16 rundll32.exe 2->16         started        signatures3 process4 dnsIp5 58 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 10->58 dropped 60 C:\Users\user\AppData\Local\...\msvcr120.dll, PE32 10->60 dropped 62 C:\Users\user\AppData\Local\...\msvcp_win.dll, PE32 10->62 dropped 64 7 other malicious files 10->64 dropped 18 Core_Tool93.exe 13 10->18         started        86 192.168.2.16 unknown unknown 13->86 88 192.168.2.24 unknown unknown 13->88 90 3 other IPs or domains 13->90 22 chrome.exe 13->22         started        25 chrome.exe 13->25         started        27 chrome.exe 13->27         started        file6 process7 dnsIp8 42 C:\ProgramData\...\ucrtbase.dll, PE32 18->42 dropped 44 C:\ProgramData\...\msvcr120.dll, PE32 18->44 dropped 46 C:\ProgramData\...\msvcp_win.dll, PE32 18->46 dropped 48 7 other malicious files 18->48 dropped 100 Switches to a custom stack to bypass stack traces 18->100 102 Found direct / indirect Syscall (likely to bypass EDR) 18->102 29 Core_Tool93.exe 7 18->29         started        74 www.google.com 142.251.153.119, 443, 49712, 49713 GOOGLE-GoogleLLCUS United States 22->74 76 mobile-gtalk.l.google.com 142.251.16.188, 49731, 5228 GOOGLE-GoogleLLCUS United States 22->76 84 2 other IPs or domains 22->84 78 142.251.155.119, 443, 49757 GOOGLE-GoogleLLCUS United States 25->78 80 142.251.163.188, 49759, 5228 GOOGLE-GoogleLLCUS United States 25->80 82 chrome.google.com 25->82 file9 signatures10 process11 file12 66 C:\Users\user\AppData\Local\...\CA098FF.tmp, PE32 29->66 dropped 68 C:\Users\user\AppData\Local\BytClient.exe, PE32 29->68 dropped 112 Contains VNC / remote desktop functionality (version string found) 29->112 114 Found hidden mapped module (file has been removed from disk) 29->114 116 Switches to a custom stack to bypass stack traces 29->116 118 Found direct / indirect Syscall (likely to bypass EDR) 29->118 33 BytClient.exe 10 71 29->33         started        signatures13 process14 dnsIp15 70 new-label.club 94.103.1.235, 3333, 3334, 49708 DHOST-ASRU Netherlands 33->70 50 C:\Users\user\AppData\Local\...\F0A963D.tmp, PE32+ 33->50 dropped 52 C:\Users\user\AppData\Local\...A66D38.tmp, PE32+ 33->52 dropped 54 C:\Users\user\AppData\Local\...3C4201.tmp, PE32+ 33->54 dropped 56 2 other malicious files 33->56 dropped 104 Tries to harvest and steal browser information (history, passwords, etc) 33->104 106 Allocates memory in foreign processes 33->106 108 Modifies the context of a thread in another process (thread injection) 33->108 110 5 other signatures 33->110 38 chrome.exe 33->38         started        40 chrome.exe 33->40         started        file16 signatures17 process18
Score:
84%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b9cfd9d7809db39171276e22315697300a26e672e3091d0a690bd1143b302837
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout SFX 7z T1059.007 Win 32 Exe x86
Link:
https://app.malva.re/file/2432ea6d9bdfb550a8076a7724553dba
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b9cfd9d7809db39171276e22315697300a26e672e3091d0a690bd1143b302837/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xhh5tv4atwzzc4jhnyrdcvuxgafcnzts4mer2ctjbpiriozqfa3q._file
Result
Malware family:
hijackloader
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader credential_access defense_evasion discovery loader privilege_escalation spyware stealer
Link:
https://tria.ge/reports/261102-pk4zzahx9t/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Detects HijackLoader (aka IDAT Loader)
Family: HijackLoader, IDAT loader, Ghostulse,
Malware Family:
HijackLoader
Create hunting rule
Verdict:
Malicious
Tags:
known_file hijackloader hijackloader config_extracted invalid_signature
YARA:
family_hijackloader hijackloader
Link:
https://app.threat.zone/submission/e30b8c20-e177-4ea2-8c6d-a3ff3cd1c5b8
Malware Family:
hijackloader
Create hunting rule
Malicious:
True
Tags:
persistence overlay obfuscated
Link:
https://intel.virussign.com/intelligence/file/b9cfd9d7809db39171276e22315697300a26e672e3091d0a690bd1143b302837
Unpacked files
SH256 hash:
b9cfd9d7809db39171276e22315697300a26e672e3091d0a690bd1143b302837
MD5 hash:
2432ea6d9bdfb550a8076a7724553dba
SHA1 hash:
d758d8313a67cf5404dc237e814f6b269f4bd0ea
Link:
https://www.unpac.me/results/7cc47e2a-375b-4c22-8406-0b214f28eb69/
SH256 hash:
4d68fa1445c40a85ecd77b86ecf2019ec996b19bcdd0a10d9e8a3bb9856849b8
MD5 hash:
ec46ba8eb27978102e38cb3d824d7b44
SHA1 hash:
0243909555bbc9ceaf1621df834ff33c2e922999
Link:
https://www.unpac.me/results/7cc47e2a-375b-4c22-8406-0b214f28eb69/
SH256 hash:
f2bd4adfe30f58dafcb76c4866d80865333f3505dac7c6f0575d1fa37b1b1de5
MD5 hash:
3a75b663585a56b41d4ceec17b889dee
SHA1 hash:
4617e9b05acbb304bd70f696878bf8f419b887aa
Link:
https://www.unpac.me/results/7cc47e2a-375b-4c22-8406-0b214f28eb69/
SH256 hash:
af2824435e01ba0847a1d3201c6f14dd703d396d5cb400ceaf99eeba7b6e7917
MD5 hash:
272453ba032bf1c0ef6ba3a89c597b81
SHA1 hash:
7c29b9c4440ba4cd50b3b6d0536b8462098a9158
Link:
https://www.unpac.me/results/7cc47e2a-375b-4c22-8406-0b214f28eb69/
SH256 hash:
54b29db856b1e86dd5fb7aee1b456b2b91056c9ecf629c298236bf5884b03036
MD5 hash:
1b0a4e33781e8fd423b6769a0a17194c
SHA1 hash:
c838a8040cb70f82d939ff97da652839b16c41d8
Link:
https://www.unpac.me/results/7cc47e2a-375b-4c22-8406-0b214f28eb69/
SH256 hash:
79baa094e2ae99c0e8570ab395a8edc7c117761aa691fd5ed631d5844bedc151
MD5 hash:
257e97f5880adaf7807556316740d19a
SHA1 hash:
fd653fd7ea57cc3a3ecacb271915beb43ddc5095
Link:
https://www.unpac.me/results/7cc47e2a-375b-4c22-8406-0b214f28eb69/
SH256 hash:
e16d30b9c2b21415bc58d7a3d07e1d58df2c45210e5abeeb70af33b31512d04e
MD5 hash:
8852e07f7aab8188a93cd40f20247c55
SHA1 hash:
ff254c29c6014a1d5d521cb425a061af3abe6437
Link:
https://www.unpac.me/results/7cc47e2a-375b-4c22-8406-0b214f28eb69/
SH256 hash:
0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
MD5 hash:
c4a25dce665733663284750666684703
SHA1 hash:
368f3c3497c1b0121409216282803bcf1b64f35f
Link:
https://www.unpac.me/results/7cc47e2a-375b-4c22-8406-0b214f28eb69/
SH256 hash:
86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
MD5 hash:
034ccadc1c073e4216e9466b720f9849
SHA1 hash:
f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
Link:
https://www.unpac.me/results/7cc47e2a-375b-4c22-8406-0b214f28eb69/
SH256 hash:
87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
MD5 hash:
fd5cabbe52272bd76007b68186ebaf00
SHA1 hash:
efd1e306c1092c17f6944cc6bf9a1bfad4d14613
Link:
https://www.unpac.me/results/7cc47e2a-375b-4c22-8406-0b214f28eb69/
SH256 hash:
9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
MD5 hash:
7762c51ea02eb943183d597ea0ee5530
SHA1 hash:
0b8c307eba01d0679a2669210862d0afa888c40f
Link:
https://www.unpac.me/results/7cc47e2a-375b-4c22-8406-0b214f28eb69/
SH256 hash:
a6edb3fb6d21dd461da3767a7995034e208f7d6b08997f6cf7ee7b0ea833a8f0
MD5 hash:
cabb58bb5694f8b8269a73172c85b717
SHA1 hash:
9ed583c56385fed8e5e0757ddb2fdf025f96c807
Link:
https://www.unpac.me/results/7cc47e2a-375b-4c22-8406-0b214f28eb69/
SH256 hash:
196e9d28ee3f516342226facdce673de2001d6824445046fa627587481c72443
MD5 hash:
9f4180cd23335534a82eadb9c4755d43
SHA1 hash:
a9dc7db904b31f827b51e6b2acfbd45cd7e6d9d8
Link:
https://www.unpac.me/results/7cc47e2a-375b-4c22-8406-0b214f28eb69/
SH256 hash:
68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abe
MD5 hash:
d4dae7149d6e4dab65ac554e55868e3b
SHA1 hash:
b3bea0a0a1f0a6f251bcf6a730a97acc933f269a
Link:
https://www.unpac.me/results/7cc47e2a-375b-4c22-8406-0b214f28eb69/
SH256 hash:
32b47e15d95dd190890ce3bf4d35661b0ea4a56dcaf04b505bec5db10f0cecd4
MD5 hash:
65b8544367b87265eedaa1a6e4295ce8
SHA1 hash:
dd28b8a4da7eebd95011dec371e178031f04b204
Link:
https://www.unpac.me/results/7cc47e2a-375b-4c22-8406-0b214f28eb69/
Malware family:
HijackLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b9cfd9d7809d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b9cfd9d7809db39171276e22315697300a26e672e3091d0a690bd1143b302837

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnappyClient

Executable exe b9cfd9d7809db39171276e22315697300a26e672e3091d0a690bd1143b302837

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/4035717/
Cape
Cape
https://www.capesandbox.com/analysis/96824/

Comments