Loading malware…
Snip3 Crypter is a Windows-focused crypter and malware delivery framework used in multi-stage intrusion chains to conceal and deploy commodity remote access trojans, notably AsyncRAT, DcRAT, and QuasarRAT. It has been associated with sustained phishing-led campaigns, including aviation-themed and tax-themed lures, and appears to operate as a crypter-as-a-service offering or shared tooling set used to deliver multiple RAT families.
Snip3 commonly appears in staged infections that begin with spearphishing emails or malicious links leading to obfuscated VBScript or PowerShell downloaders. Subsequent stages decode or retrieve additional payloads, establish persistence through startup-folder VBS launchers, and ultimately invoke the Snip3 loader. A distinctive characteristic of Snip3 is its use of embedded or compressed C# RunPE-style source code that is compiled on the victim host at runtime through .NET compilation mechanisms such as CodeDom or MSBuild-based inline C# execution. The framework then decodes a protected final payload and injects it into legitimate Windows processes using process hollowing.
Observed Snip3 loaders use defense-evasion techniques including string and API obfuscation, reversed or encoded payload storage, in-memory compilation, and execution under trusted Windows binaries. Hollowing targets have included legitimate .NET-related utilities and other signed system processes. Snip3 also establishes persistence through startup-folder scripts so that later stages or the loader are relaunched after reboot.
Snip3 itself functions primarily as the protective wrapper and execution mechanism rather than the ultimate espionage payload. In observed campaigns, the final malware has included RAT families capable of credential theft, host reconnaissance, anti-analysis checks, security-product discovery, persistence, plugin retrieval, and delivery of additional payloads. Targeting has included aviation organizations and broader enterprise users reached through themed phishing campaigns. The framework’s role is to evade detection and reliably deliver post-exploitation malware onto Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The ongoing Snip3 campaign constitutes a complex and multifaceted attack... The latest version of the Snip3 crypter is utilized... Stage-4 - The Final Stage - RAT Loader... has been used effectively by the “Snip3 Crypter crew” as the final loader in the infection chain which delivers and executes numerous RAT families onto target machines.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
The attack is initiated through a spear phishing email that has the subject line "Download your tax statement" or, in French, "Télécharger votre relevé fiscal." ... The email contains several attachments, including a corrupted PDF file ... a corrupted CSV file ... alongside the malicious script called "Votre Releve Fiscal-6.vbs"
The "HWID()" function executes a WMI Object query (" get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID ") to fetch the UUID...
The downloaded Stage-2 PowerShell script is then executed using Invoke-Expression ... Finally, the Stage-2 PowerShell Script executes and loads the decrypted Stage-3 PowerShell Script into memory using Invoke-Expression.
The INSTALL() function writes a bare minimum bit of code to disk to execute this downloaded code in the future... WriteAllText((GetFolderPath(7) + "\" + "MicroSoftOutlookLauncher.vbs"), $VBSRun.Replace("%FilePath%", $PSCommandPath))
The final chunk of code is responsible for calling the RunPE injection code, telling it to spawn regsvcs.exe , and inject the final payload $Bytes into the memory space of regsvcs.exe.
The grand majority of the code in the script is responsible for some form of obfuscation... there is a large chunk of non-English Unicode characters that eventually get removed to produce this PowerShell code.
telling it to spawn regsvcs.exe , and inject the final payload $Bytes into the memory space of regsvcs.exe.
The final chunk of code is responsible for calling the RunPE injection code, telling it to spawn regsvcs.exe , and inject the final payload $Bytes into the memory space of regsvcs.exe.
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A multi-stage crypter/loader delivered via spear-phishing VBS and PowerShell stages. It establishes persistence through startup VBS scripts, decrypts successive in-memory PowerShell stages, downloads additional payloads from attacker-controlled servers, dynamically compiles RunPE code with CodeDom, and uses process hollowing to inject final RAT payloads into legitimate processes such as AppLaunch.exe and RegAsm.exe.
Crypter used to protect and deploy the final payload. It delivers a PowerShell stage, compiles raw C# RunPE code on the victim host, and injects the embedded payload into regsvcs.exe via process hollowing.
Crypter/service infrastructure assessed as likely related to this campaign based on shared sender IP, C2 IP address, and final payload artifacts.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.