# SnakeKeylogger Infostealer Delivered via Phishing Emails Disguised as Project Proposals (ASEC, JS→PowerShell Fileless Loader)

> ASEC identified an active phishing campaign delivering the SnakeKeylogger (aka Snake Stealer / 404 Keylogger) .NET infostealer through emails disguised as project proposal requests. A compressed attachment contains obfuscated JavaScript that spawns PowerShell to decrypt and reflectively load SnakeKeylogger entirely in memory, which then harvests browser credentials, credit-card data, Outlook profiles, clipboard, screenshots, and keystrokes before exfiltrating over attacker-controlled SMTP or Telegram.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1255
- **ID:** TL-2026-1255
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-07-09 ASEC (AhnLab Security Intelligence Center) reported a phishing campaign impersonating legitimate business project-proposal requests to deliver the commodity .NET infostealer SnakeKeylogger (also tracked as Snake Stealer / 404 Keylogger). Victims receive an email with a compressed archive attachment; inside is an obfuscated JavaScript file disguised as a document. When opened, the JavaScript invokes PowerShell.exe and passes an AES-encrypted SnakeKeylogger payload as an inline argument. PowerShell decrypts the payload and executes it directly in the process's memory space without ever writing the final payload to disk, evading disk-based AV/EDR signature detection (fileless execution / defense evasion).

Once resident in memory, SnakeKeylogger's loader unpacks itself in stages: it parses AES-encrypted blobs stored in the .NET assembly's .RSRC resource section, derives the AES-ECB key by SHA-256-hashing a hardcoded key string, and decrypts a secondary loader stage. That stage contains two further AES-ECB-encrypted resource entries, the last of which houses a RUNPE (process-hollowing style) injector module plus the final SnakeKeylogger payload. The malware performs anti-analysis checks before running: a build-date/current-date comparison acts as a kill switch, it uses the native `choice.exe /T` timeout utility to delay execution/cleanup, it enumerates and can terminate known AV/security-tool processes, and it checks the infected host's public IP (via checkip.dyndns.org) against a sandbox/bot IP blocklist, aborting payload execution if a sandbox is detected. It also queries geolocation data from reallygeoip.org as part of victim triage.

For persistence, SnakeKeylogger writes itself to a registry Run key so it survives reboot. It has also been observed dropping a copy of the executable to the user's Temp directory and creating a matching CLR usage-log artifact under `AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\`, consistent with typical .NET obfuscator/protector (e.g. ConfuserEx-style) execution artifacts.

Collection capability is broad: it targets an extensive list of Chromium- and Gecko-based browsers (Chrome, Edge, Opera, Epic Privacy Browser, QQ Browser, etc.) to steal saved passwords and stored credit-card data from the browsers' Login Data / Web Data SQLite stores; it harvests Outlook account/profile configuration directly from the Windows registry; it logs all keystrokes system-wide; it periodically captures desktop screenshots (saved locally as Screenshot.jpg under My Documents before exfiltration); and it monitors and exfiltrates clipboard contents (useful for capturing crypto-wallet addresses and copied credentials). It also performs local system/network reconnaissance (OS/hardware info, installed software enumeration, network configuration) prior to exfiltration.

Exfiltration is configuration-driven and supports three interchangeable channels controlled by build-time flags: FTP (`%FTPDV$`), Telegram bot API (`$%TelegramDv$`), and SMTP (`$%SMTPDV$`). In this campaign the operator configured SMTP exfiltration: stolen data (browser passwords, harvested credentials) is Base64-encoded, packaged into text attachments (observed names such as `Passwords.txt` / `User.txt`), and emailed out via an attacker-controlled SMTP relay (`mail.trimnt.com`, account `nova3@mnt.com`) over TLS/STARTTLS on port 587 to a Gmail drop address (`keishstanford5@gmail.com`). SnakeKeylogger operators are known to abuse compromised third-party mailboxes as SMTP relays to blend exfiltration traffic with legitimate mail flow and to validate successful C2 delivery by checking for a `#$0#` marker string in the server response. This use of a fileless, in-memory-only final payload combined with disposable SMTP/Telegram drop infrastructure is characteristic of the low-cost, high-volume commodity-infostealer-as-a-service ecosystem that SnakeKeylogger (marketed historically as "404 Keylogger") has operated in since 2019-2020.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1547.001 Registry Run Keys / Startup Folder
- T1140 Deobfuscate/Decode Files or Information
- T1218 System Binary Proxy Execution
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1497.001 System Checks
- T1027 Obfuscated Files or Information
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1056.001 Keylogging
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1518 Software Discovery
- T1012 Query Registry
- T1614 System Location Discovery
- T1005 Data from Local System
- T1114 Email Collection
- T1115 Clipboard Data
- T1113 Screen Capture
- T1056 Input Capture
- T1071.003 Mail Protocols
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol

## Sources

- [Beware of Phishing Emails Disguised as Project Proposals](https://asec.ahnlab.com/en/94433/)
- [Under the Hood of SnakeKeylogger: Analyzing its Loader and its Tactics, Techniques, and Procedures](https://www.splunk.com/en_us/blog/security/under-the-hood-of-snakekeylogger-analyzing-its-loader-and-its-tactics-techniques-and-procedures.html)
- [Analyzing Snake Keylogger in ANY.RUN: a Full Walkthrough](https://any.run/cybersecurity-blog/analyzing-snake-keylogger/)
- [Snake infostealer Malware Analysis, Overview by ANY.RUN](https://any.run/malware-trends/snakekeylogger/)
- [FortiSandbox 5.0 Detects Evolving Snake Keylogger Variant](https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant)
- [Malware Analysis: Snake Keylogger/Snake Stealer](https://medium.com/@0x747863/malware-analysis-snake-keylogger-snake-stealer-bbcc91705089)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1255