SnappyClient RAT screen capture and keylogging via VirtualAr.exe (Operation Turb00)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•3

Detects behavior associated with the SnappyClient remote access trojan, specifically identifying the execution of 'VirtualAr.exe', which performs GDI-based screen capture and keyboard hooking via 'SetWindowsHookEx', followed by the staging of stolen data within the 'ProgramData\Mayanex\Nata' directory.