404 Keylogger
Aliases: 404KeyLogger, Snake Keylogger
- First seen
- 2019-08-01 00:00:00
- Malware type
- keylogger, credential-stealer, screen-capture, spyware
- Family
- Malware family
- Last IoC activity
- 2026-07-21 11:13:57
- Profile updated
- 2026-07-07 14:03:08
Targeted industries: financial-services technology-and-telecommunications healthcare-and-pharmaceutical government-and-public-sector retail-and-hospitality
Context
Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victim’s sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.
Detection coverage
- 1 YARA rules
Detection rules
- DITEKSHEN_MALWARE_Win_Phoenix (yara-rule)
Reports & references
- blogs.blackberry.com — Dot Net Stubs Sowing The Seeds Of Discord (report)
- ptsecurity.com — Steganoamor Campaign Ta558 Mass Attacking Companies And Public Institutions All Around The World (report)
- malwarebookreports.com — Cross Platform Java Dropper Snake And Xloader Mac Version (report)
- malpedia.caad.fkie.fraunhofer.de — Win.404Keylogger (report)
- x-junior.github.io — Snakekeylogger (report)
- any.run — Reverse Engineering Snake Keylogger (report)
- habr.com — 477198 (report)
- bitsight.com — Exfiltration Over Telegram Bots Skidding Infostealer Logs (report)
- ciphertechsolutions.com — Roboski Global Recovery Automation (report)
- cybereason.com — Threat Analysis Report Snake Infostealer Malware (report)
- insights.infoblox.com — Threat Intelligence 102 (report)
- malwarebytes.com — 20221121 Threat Intel Report Final (report)
- zscaler.com — Technical Analysis Purecrypter (report)
- twitter.com — 1401921257109561353 (report)
- youtube.com — Watch (report)
- CERT-UA — 955924 (report)
- securityintelligence.com — Roboski Global Recovery Automation (report)
- aryaka.com — Snake Infostealer Smtp Data Exfiltration (report)
- fortinet.com — Deep Dive Into A Fresh Variant Of Snake Keylogger Malware (report)
- threatresearch.ext.hp.com — The Many Skins Of Snake Keylogger (report)
- any.run — Analyzing Snake Keylogger (report)
- zw01f.github.io — Snake (report)
- blog.netlab.360.com — Purecrypter (report)
- securityintelligence.com — Spam Trends Campaigns Senior Superlatives 2023 (report)
- blogs.blackberry.com — Threat Thursday Unique Delivery Method For Snake Keylogger (report)