Last seven days
- First activity
- Jul 27, 2026
- Last activity
- Jul 27, 2026
- Feed role
- C2
- Host form
- 0 IP / 1 hostnames
SnakeKeylogger
SnakeKeylogger, also known as 404 Keylogger and in some campaigns rebranded as VIPKeylogger, is a Windows-focused .NET credential-stealing malware family active since at least late 2020.
Profile source: Mallory opens in a new tabSnakeKeylogger
Family profile
SnakeKeylogger, also known as 404 Keylogger and in some campaigns rebranded as VIPKeylogger, is a Windows-focused .NET credential-stealing malware family active since at least late 2020. It overlaps functionally with commodity stealers such as Agent Tesla and is used primarily for theft of credentials and other sensitive user data from compromised endpoints.
The malware is associated with phishing-led intrusion chains that commonly use business or logistics lures, including proposal, purchase-order, invoice, and DHL-themed messages. Observed delivery mechanisms include malicious JavaScript, VBScript, PowerShell, and macro-enabled Microsoft Word documents. Several campaigns used staged loaders that decrypt SnakeKeylogger in memory, reflective .NET loading, abuse of legitimate Windows components, and process hollowing into trusted .NET binaries to reduce on-disk artifacts and evade detection. Some variants have also been delivered through broader malware distribution ecosystems and loaders.
SnakeKeylogger’s core behavior includes keylogging, theft of browser-stored data, collection of system information, and credential harvesting. Reported variants target credentials and data from numerous Chromium- and Gecko-based browsers as well as email and file-transfer clients. Additional observed collection includes clipboard contents, screenshots, Wi-Fi credentials, Discord-related data, and other locally stored secrets. Exfiltration has been observed over SMTP and Telegram, and some later variants also support HTTP POST, FTP, and Discord webhooks. VIPKeylogger-branded samples have been described as using dual-channel exfiltration, particularly SMTP and Telegram simultaneously.
The family is frequently protected with obfuscation and encrypted configuration or payload stages, including custom XOR-based loaders and, in some reported variants, RSA and AES for configuration and communications. Campaigns have also shown anti-analysis measures, persistence via scheduled tasks or startup mechanisms, and use of social engineering combined with trusted-process abuse. SnakeKeylogger remains effective because it combines simple credential-theft objectives with low-cost delivery and broad compatibility across poorly secured Windows endpoints.
Capabilities
- Credential Theft
- Defense Evasion
- Exfiltration
- Keylogging
- Persistence
- Process Injection
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
1 Jul 27
Observed infrastructure
Leading locations
- DE1
Leading providers
- Hetzner Online GmbH1
Infrastructure traits
- Hosting 1
Samples
Recent associated samples
MITRE ATT&CK
SnakeKeylogger in ATT&CK
45 distinct techniquesTechniques
45 techniques T1115 Clipboard Data T1555 Credentials from Password Stores T1555.003 Credentials from Web Browsers T1620 Reflective Code Loading T1204.002 Malicious File T1048 Exfiltration Over Alternative Protocol T1027 Obfuscated Files or Information T1059.001 PowerShell T1059 Command and Scripting Interpreter T1005 Data from Local System T1566 Phishing T1059.007 JavaScript T1056.001 Keylogging T1105 Ingress Tool Transfer T1059.005 Visual Basic T1070.004 File Deletion T1059.003 Windows Command Shell T1218.011 Rundll32 T1555.005 Password Managers T1113 Screen Capture T1547.001 Registry Run Keys / Startup Folder T1027.002 Software Packing T1027.003 Steganography T1614 System Location Discovery T1071.001 Web Protocols T1608.001 Upload Malware T1047 Windows Management Instrumentation T1041 Exfiltration Over C2 Channel T1055.012 Process Hollowing T1112 Modify Registry T1036 Masquerading T1528 Steal Application Access Token T1568.002 Domain Generation Algorithms T1567 Exfiltration Over Web Service T1102 Web Service T1480 Execution Guardrails T1053.005 Scheduled Task T1622 Debugger Evasion T1566.001 Spearphishing Attachment T1027.010 Command Obfuscation T1497.003 Time Based Checks T1082 System Information Discovery T1140 Deobfuscate/Decode Files or Information T1547 Boot or Logon Autostart Execution T1016 System Network Configuration Discovery
