{
  "family": "snoload",
  "sample_count": 2,
  "category": "ransomware",
  "description": "TrojanDownloader:Win32/Snoload is a stealthy, first-stage downloader designed specifically to establish a foothold on a compromised system and securely retrieve secondary, more dangerous payloads from an attacker-controlled Command and Control (C2) server (`T1105`). It is built to be small, evade initial detection, and act as the gateway for larger threats like banking trojans or ransomware.<br><br><b>Understanding Snoload (Trojan Downloader)</b><br>To an end-user, a Snoload infection is entirely silent. They may open a seemingly benign email attachment, and when nothing happens, assume the file was corrupt. For a SOC analyst, a Snoload detection is a critical early warning. The primary objective is not just to quarantine Snoload, but to determine exactly what it downloaded before it was stopped.<br><br><b>Execution and Evasion Strategies</b><br>Snoload is typically delivered via spearphishing campaigns utilizing weaponized Microsoft Office macros (`T1566.001`) or malicious JavaScript/VBScript attachments. Upon execution, the script unpacks or decrypts the small Snoload executable. Snoload often uses techniques like API hashing and encrypted strings to hide its C2 domains from static analysis (`T1027`). Once running, it reaches out to its C2 server via HTTPS. It downloads the secondary payload (often a heavily encrypted blob), decrypts it in memory, and uses Process Injection (`T1055`) to execute the final payload within the context of a legitimate system process, completely bypassing disk-based antivirus scanning.<br><br><b>Indicators of Compromise (IoCs)</b><br>The most crucial IoCs are behavioral and network-based. EDR telemetry will show an unusual process tree (e.g., `winword.exe` -> `cmd.exe` -> `powershell.exe` -> `snoload.exe`). Network IoCs include the initial outbound beaconing to suspicious domains or IP addresses. The definitive behavioral IoC is Snoload attempting to allocate memory and write code into another process (`Process Hollowing` or `Process Injection`).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1027",
    "T1566.001",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (The core function of downloading the secondary payload)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Injecting the downloaded payload directly into memory)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information (Hiding C2 domains and API calls from static analysis)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment (Primary delivery mechanism via weaponized documents)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; if Snoload executed successfully, a secondary, highly destructive payload is likely running in memory.",
    "Capture a live memory image (RAM dump) *before* rebooting the machine to extract the injected secondary payload and identify the true threat.",
    "Analyze EDR and proxy logs to identify the C2 domains Snoload contacted, and block those domains at the enterprise firewall.",
    "Analyze the parent process (e.g., Outlook, Word) to determine the initial phishing vector and purge similar emails from the enterprise environment."
  ],
  "what_to_avoid": [
    "Do not close the incident just because the AV deleted the initial 'Snoload' executable; you must verify that the secondary payload was not downloaded and injected.",
    "Avoid relying solely on file hashes to hunt for Snoload, as attackers constantly repack the binaries to generate new hashes."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}