Inside SnipBot: The Latest RomCom Malware Variant

This report documents SnipBot, a newly observed RomCom 5.0 backdoor (Dec 2023–Jun 2024) that uses signed downloader executables, novel obfuscation and sandbox-evasion checks, COM-hijack persistence to inject DLLs into explorer.exe, and a feature-rich backdoor (file listing/upload/download, remote command execution, SOCKS/SSH proxying and targeted exfiltration). The authors reconstructed infection chains, post-infection activity via Cortex XDR telemetry, and provide extensive IoCs (SHA256 hashes, domains, IPs, registry keys) and detection/mitigation recommendations.