MALWARE FAMILY

404 Keylogger

Internal ID: win.404keylogger

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victim’s sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.

Threat Analysis

404 Keylogger is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://any.run/cybersecurity-blog/analyzing-snake-keylogger/

→https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/

→https://blog.netlab.360.com/purecrypter

→https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/

→https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord

→https://blogs.blackberry.com/en/2022/06/threat-thursday-unique-delivery-method-for-snake-keylogger

→https://cert.gov.ua/article/955924

→https://habr.com/ru/company/group-ib/blog/477198/

→https://insights.infoblox.com/threat-intelligence-reports/threat-intelligence--102

→https://insights.infoblox.com/threat-intelligence-reports/threat-intelligence--89

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.404keylogger

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search 404 Keylogger