Borrowed Machinery: SnappyClient, HijackLoader, and a Shared Codebase?

1. Overview

SnappyClient has only ever been seen delivered by HijackLoader, but what sits between the two varies. In some samples HijackLoader loads the payload directly. In others its config carries a 32-bit PE that unpacks SnappyClient and runs it first.

Zscaler have written about overlaps between HijackLoader and SnappyClient, and they raised a possible connection between the developers. That is what I went looking for.

The SnappyClient sample here is version 0.1.22 , compiled on 2026-04-02. This detail is important, as I’ve observed throughout my tracking, that newer versions, from 0.1.29 do not have the loader, and Hi…