Loading malware…
SnakeKeylogger, also known as 404 Keylogger and in some reporting closely associated with the VIPKeylogger rebrand or variant, is a Windows-focused .NET infostealer centered on credential theft and keystroke capture. Active since at least late 2020, it overlaps functionally with commodity stealers such as Agent Tesla and is widely used in phishing-driven credential theft operations.
SnakeKeylogger commonly steals saved data from web browsers and email clients, captures system information, records keystrokes, and in more recent observed variants also targets FTP credentials, Discord tokens, Wi-Fi passwords, clipboard contents, screenshots, and browser-stored payment data. Exfiltration has repeatedly been observed over SMTP and Telegram, and some newer samples also support HTTP POST, FTP, and Discord webhook-based data theft. Reporting also links the malware to Outlook-related credential access behavior and time-delay evasion using choice.exe.
Observed delivery chains are diverse but consistently rely on social engineering. Campaigns have used phishing emails themed as project proposals, purchase orders, invoices, and DHL-related business communications. Attachments and first stages have included malicious JavaScript, VBScript, VBE, PowerShell, and macro-enabled Microsoft Word documents. Some chains execute SnakeKeylogger fully in memory, while others use staged .NET loaders, steganographic carriers, or compromised legitimate websites and cloud-hosted content to retrieve encrypted payloads.
SnakeKeylogger operators and distributors frequently employ defense-evasion techniques. Document-based chains have abused Advpack.dll to execute INF files, while script-based chains have used heavy obfuscation, custom encryption, reflective .NET loading, anti-sandbox delays, and process hollowing. Multiple 2026 campaigns used .NET loaders named DEV.dll with the DEV.DOWN.SHOOT entry point to hollow legitimate Microsoft .NET binaries such as Aspnet_compiler.exe, RegAsm.exe, and Caspol.exe. Persistence has been observed through scheduled tasks, startup items, and Run-key style autoruns in related chains.
The malware is broadly distributed through commodity malware ecosystems and malware-as-a-service delivery infrastructure. PureCrypter has been observed propagating SnakeKeylogger alongside other stealers and RATs. Telegram has served not only as an exfiltration channel but also as part of the surrounding criminal ecosystem for operating and monetizing infostealer activity. SnakeKeylogger has appeared prominently in large collections of Telegram-exfiltrated infostealer logs, indicating substantial operational scale.
SnakeKeylogger primarily threatens organizations and individuals through theft of credentials and other sensitive endpoint data that can be reused for account compromise, follow-on intrusion, and access brokerage. Campaign lures have notably targeted business users involved in procurement, shipping, finance, and general corporate communications, but the malware is not limited to a single industry vertical.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
ASEC recently confirmed that phishing emails disguised as project proposals are being circulated. The body of the email pretends to request that the proposal and confirmed delivery schedule be submitted as soon as possible, and prompts the recipient to download the attached compressed file.
Execution is handled through WMI rather than direct process creation ... infare.Get("Win32_Process").Create(avaram, Null, circumsail, mayas)
When executed, the JavaScript malware executes PowerShell commands...
When executed, the JavaScript malware executes PowerShell commands as shown in [Figure 4].
the first check we need to observe when it comes to office files is the existence of Macros which are used by the TA to execute VBA commands | FlkMT is responsible for building the payload which will be written in TEMP Directory using WHTLE function
The PowerShell script receives encrypted SnakeKeylogger data as an argument from within the JavaScript file, decrypts it, and executes it in memory without saving it to disk. [Figure 3] Part of the obfuscated JavaScript malware [Figure 4] Part of the obfuscated PowerShell script
The extracted assembly ... includes anti-analysis checks ... An encrypted configuration blob in the User Strings heap contains the Telegram bot token and SMTP credentials -- protected by Babel's obfuscation layer
The decoded PowerShell downloads a JPEG image from Cloudinary CDN ... with 1.55 MB of Base64-encoded .NET assembly appended after the image data.
then it will erase his row existence as the process has been executed and delete the 3 dropped files (VN.inf , cvr.tmp, and xhd.jpg)
ruNDLl32 %TEmP%\xhd.jpg,main here the TA uses Rundll32 which is used to run a DLL and execute xhd.jpg and the export function here is main | Snake uses this method to run the Inf file under a legitimate container or process... it calls a function called tAcKs() and this function is defined as LunachINFSectionW from Advpack.dll
Other kinds of highly sensitive data that infostealers often collect are screenshots, keylogs, clipboard, cryptocurrency wallets and autofill data, the latter occasionally containing credit card info.
This type of malware steals all kinds of data from the system it infects, including credentials (passwords and cookies) for VPNs, RDP, business services, banking and social media, stored by a variety of apps (including popular browsers like Chrome and Firefox).
Útočník dokonca môže heslá extrahovať na ďalšie použitie.
SnakeKeylogger—an Infostealer—collects various types of information from the infected system, such as web browser data, system information, and keylogging data
Other kinds of highly sensitive data that infostealers often collect are screenshots, keylogs, clipboard, cryptocurrency wallets and autofill data, the latter occasionally containing credit card info.
Exfiltration Exfiltration Over C2 Channel T1041 SMTP/HTTP exfiltration
Like the average Infostealer, DarkCloud steals the account credentials of users that have been saved on web browsers, FTP, and email clients. It is also similar to other Infostealers like AgentTesla and SnakeKeylogger as it uses SMTP or the Telegram API to send the collected information to the C&C server.
57 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An infostealer/keylogger delivered via phishing emails as a JavaScript attachment. The JavaScript launches PowerShell, which decrypts the SnakeKeylogger payload and executes it in memory. It steals browser data, system information, and keystrokes, then exfiltrates the data via SMTP or Telegram.
A keylogger family also known as 404 Keylogger. In this content it is described as the parent family/variant lineage for VIPKeylogger, with VIPKeylogger adding dual-channel SMTP and Telegram exfiltration.
A keylogger family also known as 404 Keylogger. In this content it is described as the parent family/variant lineage for VIPKeylogger, with VIPKeylogger adding dual-channel SMTP and Telegram exfiltration.
A .NET stealer/keylogger assessed as the stage 3 payload in this chain. It is described as capable of keylogging, credential harvesting from browsers, email and FTP clients, screenshot capture, clipboard monitoring, SMTP exfiltration, and persistence.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.