SnakeKeylogger
SnakeKeylogger, also known as 404 Keylogger, is a .NET infostealer/keylogger active since at least late 2020 and described as overlapping functionally with AgentTesla. The content also states that VIPKeylogger is a direct variant or rebrand of SnakeKeylogger. Reported capabilities include keystroke logging, credential theft, clipboard capture, and screenshot capture. SnakeKeylogger v4.4 is specifically described as stealing credentials from more than 40 Chromium- and Gecko-based browsers, as well as targeting Outlook, Foxmail, Thunderbird, Postbox, FileZilla, Discord tokens, Chromium credit card data, and WiFi passwords. It also performs keylogging via SetWindowsHookExA and supports exfiltration over HTTP POST, FTP STOR, Telegram Bot API, Discord webhooks, and in some variant reporting, SMTP and Telegram simultaneously. The malware has been observed delivered through multiple phishing-driven chains, including large obfuscated PowerShell, VBScript, JavaScript, and VBE droppers, as well as staged payloads hosted on compromised websites, Internet Archive, and Cloudinary. Several analyzed chains used reflective loading of a .NET loader named DEV.dll with entry point DEV.DOWN.SHOOT, followed by process hollowing into legitimate .NET binaries including Aspnet_compiler.exe, RegAsm.exe, and in VIPKeylogger reporting, Caspol.exe. Persistence observed in related chains included scheduled tasks, Run keys, Startup-folder VBS/LNK artifacts, and use of C:\Users\Public\Downloads\ or C:\Temp\ as staging paths. High-confidence infrastructure and indicators directly mentioned in the content include SHA-256 hashes 580208dc3ab732da63205c34e6b98e11810f5d17d6b602ff9d1029873d418474 for a SnakeKeylogger v4.4 payload, 1c5c15bbed9b6056298187a2fe7d808d8ecc38db0b17c6b18250f9e521028f74 and ff24355a2670aa64b6633a6a154682f42e3a0ec9137c575327967f4baa9bd2df for DEV.dll loaders used in SnakeKeylogger-classified chains, and infrastructure including varders[.]kozow[.]com, aborters[.]duckdns[.]org, anotherarmy[.]dns[.]army, 51[.]38[.]247[.]67:8081, 176[.]61[.]151[.]122, 192[.]210[.]186[.]208/web/ENCRYPT.Ps1, 144[.]172[.]105[.]88, and SMTP host mail.miniorangeman.com:587. The content associates SnakeKeylogger activity with phishing campaigns using purchase-order, invoice, trade, and DHL-themed lures, and notes targeting of procurement, shipping, accounts receivable, and organizations in Germany in specific observed campaigns.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
33 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
Execution
5 techniques
Execution
Execution is handled through WMI rather than direct process creation ... infare.Get("Win32_Process").Create(avaram, Null, circumsail, mayas)
The VBScript dropper ... launches PowerShell invisibly via WMI's Win32_Process.Create with ShowWindow=0
Persistence
3 techniques
Persistence
Privilege Escalation
3 techniques
Privilege Escalation
Stealth
9 techniques
Stealth
MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Obfuscated Files or Information T1027 Rotational XOR, Unicode padding, hex encoding
The extracted assembly ... includes anti-analysis checks ... An encrypted configuration blob in the User Strings heap contains the Telegram bot token and SMTP credentials -- protected by Babel's obfuscation layer
The decoded PowerShell downloads a JPEG image from Cloudinary CDN ... with 1.55 MB of Base64-encoded .NET assembly appended after the image data.
Defense Evasion Obfuscated Files or Information: Command Obfuscation T1027.010 Character-by-character URL concatenation
"It performs process hollowing into Aspnet_compiler.exe -- a legitimate .NET Framework tool"
Defense Evasion Execution Guardrails T1480 Timer ensures sandbox timeout before payload
Defense Impairment
1 technique
Defense Impairment
Credential Access
5 techniques
Credential Access
MITRE ATT&CK Mapping Tactic Technique ID Implementation Credential Access Steal Application Access Token T1528 Discord token extraction from LevelDB
Credential Access Credentials from Password Stores T1555 Browser/email credential harvesting
Discovery
2 techniques
Discovery
Collection
3 techniques
Collection
Command and Control
4 techniques
Command and Control
Command and Control Application Layer Protocol: Web Protocols T1071.001 HTTP GET to C2 on port 80
Command and Control Web Service T1102 Cloudinary/Internet Archive for staging
IOCs tracked for this family
46 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A keylogger family also known as 404 Keylogger. In this content it is described as the parent family/variant lineage for VIPKeylogger, with VIPKeylogger adding dual-channel SMTP and Telegram exfiltration.
A keylogger family also known as 404 Keylogger. In this content it is described as the parent family/variant lineage for VIPKeylogger, with VIPKeylogger adding dual-channel SMTP and Telegram exfiltration.
A .NET stealer/keylogger assessed as the stage 3 payload in this chain. It is described as capable of keylogging, credential harvesting from browsers, email and FTP clients, screenshot capture, clipboard monitoring, SMTP exfiltration, and persistence.
Credential stealer and keylogger used as the final injected payload, employing RSA+AES encryption for configuration and communications.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.