en
404 KeyloggerSnake Stealer keylogger moduleSnakeKeyloggerSnake Keylogger (also known as 404 Keylogger, Snake Stealer keylogger module and SnakeKeylogger) is an information-stealing malware family. Snake Keylogger targets browser credentials, Email client credentials (Thunderbird, Outlook), Keystroke capture, Clipboard content, Screenshots and FTP/RDP session credentials. As of 11/10/2026, CyStack's research assesses high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
Snake Keylogger, also tracked as 404 Keylogger, is a .NET-based info-stealer and keylogger first documented in late
2020. The malware harvests keystrokes, saved browser
credentials, clipboard content, and screenshots, then
exfiltrates them over one of three C2 channels: FTP, SMTP,
or Telegram bot. Newer builds prefer the Telegram
sendDocument API.
The password-harvesting module writes stolen credentials
to a file named bot-<chatid>-<msgid>-<victim>-SnakePW.txt
that opens with the PW | USER | Snake module tag. Each
credential record sits inside a
-------- Snake Tracker -------- bracketed block with
Found From:, Host:, USR:, and PSWD: lines. The
top of the file carries victim identity fields: PC Name,
Date and Time, Client IP, plus a geo block (Country
Name / CountryCode / Region / City / TimeZone / Latitude /
Longitude) that fills with the literal {Null} placeholder
when the ipapi.co lookup failed or the operator disabled
it.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
