ctrlINT What the industry said about every indicator, with the quote

404 KeyloggerMalware

  • 404keylogger
  • Snake Keylogger

Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victim’s sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019.From MISP Galaxy

Last reported 16 days ago, by AhnLab ASEC3 reports

ATT&CK techniques

3 techniques · each with the sentence it comes from
  1. T1036Masquerading

    “To evade detection, the actor employs multi-layered, highly obfuscated stages, including extensive junk code and an AutoIt/Lua loader masquerading as a TrueType Font (.ttf) file.”

    Fortinet Threat ResearchVendor
  2. T1053.005Scheduled Task

    “…YESSSSSSSS.' If both conditions are met, the script copies itself to the %PUBLIC%\Libraries folder and establishes persistence via a Scheduled Task.”

    Fortinet Threat ResearchVendor
  3. T1055Process Injection

    “It then locates a local data file, decrypts it using XOR, and finally uses low-level ntdll.dll functions to perform process injection and execute the payload.”

    Fortinet Threat ResearchVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

3 reports, newest first · the exact sentence from each

  1. “Snake Keylogger establishes persistence through the Registry’s Run key and then steals keyboard input, clipboard data, screen captures, Wi-Fi passwords, browser and email account information, FileZilla login credentials, Discord tokens, public IP addresses, and location data.”

    AhnLab ASECVendor
    Beware of Phishing Emails Disguised as Purchase Orders

  2. “…e Exploit forum in autumn 2025 and now underpins dozens of campaigns delivering AsyncRAT, Agent Tesla, Remcos, XWorm, ValleyRAT and Snake Keylogger.”

    Infosecurity MagazineNews
    Cruciferra Crypter Uses Process Ghosting to Evade Detection

  3. “The identified payloads include Remcos, Agent Tesla, XWorm, and Snake Keylogger variants.”

    Fortinet Threat ResearchVendor
    The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with 404 Keylogger here?
No account needed. We do not store your IP address.