Malware

404 Keylogger

Also known as: 404KeyLogger · Snake Keylogger

Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victim’s sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.

Indicators of Compromise 2

Filename GoFlyDrv.sys Filename putty

MITRE ATT&CK TTPs 12

T1006
Direct Volume Access
Defense Evasion
 T1012
Query Registry
Discovery
 T1014
Rootkit
Defense Evasion
 T1053.005
Scheduled Task
Execution
 T1055
Process Injection
Defense Evasion
 T1055.015
ListPlanting
Defense Evasion
 T1068
Exploitation for Privilege Escalation
Privilege Escalation
 T1070.004
File Deletion
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1204.002
Malicious File
Execution
 T1548.002
Bypass User Account Control
Privilege Escalation

Source Articles

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
Cruciferra, a sophisticated crypter service linked to a China-based cybercrime group, is being used to deliver remote access trojans (RATs) and information stealers via phishing campaigns. It leverages advanced evasion techniques such as BYOVD, Process Ghosting, and API unhooking to avoid detection and hinder analysis. The threat targets multiple sectors including finance, healthcare, and government, primarily through tax-themed and social engineering lures. The malware establishes persistence via registry modifications and executes payloads in memory to minimize forensic traces.
hacker-news ·1d ago