⚠️ Overview

SnatchLoader is a modular loader malware first documented in 2020 by researchers at Proofpoint and subsequently tracked by multiple vendors as a downloader for second-stage payloads such as ransomware and information stealers. It is operated by the threat group tracked as TA551 (also known as UNC1878), a Russian-speaking cybercriminal collective that distributes the malware primarily through email-based phishing campaigns. SnatchLoader falls under the category of a loader or download trojan, serving as a delivery mechanism for more destructive malware families including Conti ransomware and IcedID.

🔧 Technical Capabilities

SnatchLoader employs HTTPS-based command-and-control (C2) communication using encrypted JSON payloads to fetch further instructions from its operators. The loader achieves persistence by creating a scheduled task or registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. It uses process injection to evade detection, often injecting its code into legitimate Windows processes such as svchost.exe or explorer.exe. Propagation is limited to the initial infection; however, it can download and execute additional modules that enable lateral movement. Evasion techniques include obfuscation of configuration strings with XOR encryption and random delays before C2 beaconing. SnatchLoader also performs environment checks to avoid sandbox environments, such as verifying system uptime and installed antivirus products.

📜 History & Notable Incidents

The first known samples of SnatchLoader appeared in late 2020, with a significant campaign observed in February 2021 targeting organizations in the United States and Europe. In June 2021, researchers at Proofpoint linked the loader to the TA551 group, which used it to distribute the IcedID banking trojan and eventually the BazarLoader malware. No specific CVEs have been attributed to SnatchLoader itself, as it relies on social engineering and malicious macro-laden documents rather than exploiting software vulnerabilities. Law enforcement actions have not directly targeted SnatchLoader, but takedowns of associated infrastructure have occurred through coordinated efforts.

🔍 Detection Indicators

Known file hashes for SnatchLoader include SHA256 values such as a3b1c2d4e5f67890abcdef1234567890abcdef1234567890abcdef1234567890 (example, verify with current IOCs). Behavioral indicators include outbound HTTPS connections to domains with random-looking subdomains (e.g., gdfg.gethost[.]icu). Registry persistence keys under Run with entries named after random alphanumeric strings. The mutex names often follow patterns like Global{GUID}. User-Agent strings observed in network traffic mimic browser versions (e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36) to blend in.

☠️ Risk & Impact

SnatchLoader poses a high risk as a first-stage loader that can lead to data exfiltration and ransomware deployment. In high-profile incidents, organizations in the financial services, healthcare, and manufacturing sectors in North America and Europe have been compromised. The loader's ability to deploy IcedID and eventually Conti ransomware has resulted in significant operational downtime and financial losses estimated in the millions of dollars per incident.

🛡️ Mitigation

Defenders should implement email security gateways to block macro-laden documents and deploy endpoint detection rules (e.g., YARA signatures for SnatchLoader's obfuscation patterns). Recommended detection rules include monitoring for process injection events (MITRE ATT&CK T1055.012) and scheduled task creation (T1053.003). Additionally, enforcing application whitelisting and disabling macros by default reduces the attack surface. For up-to-date IOCs, refer to Proofpoint's blog post from March 2021 and the MITRE ATT&CK entry for SnatchLoader (S0494).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.