WhiteSnake Stealer
- First seen
- 2022-02-01 00:00:00
- Malware type
- credential-stealer, keylogger, spyware
- Family
- Malware family
- Last IoC activity
- 2026-05-19 02:37:01
- Profile updated
- 2026-07-07 15:26:22
Context
WhiteSnake Stealer, discovered in February 2022, is a sophisticated .NET data-stealing malware that targets browsers, applications, and crypto wallets. The builder can build payloads in different file formats such as EXE, SCR, COM, CMD, BAT, VBS, PIF, WSF, .hta, MSI, PY, DOC, DOCM, XLS, XLL, XLSM. Some of these (python, bash) allow the malware to run on Linux systems. The stealer has two execution methods: * Non-resident - the stealer auto-deletes itself after successful execution * Resident - the stealer beacons out to the C2 (possibly in the TOR network) WhiteSnake Stealer can gather system information, execute remote commands, spread through USB drives, and perform tasks like keylogging, file management, and webcam access.
Detection coverage
- 3 YARA rules
Detection rules
- RUSSIANPANDA_Whitesnakestealer (yara-rule)
- RUSSIANPANDA_Whitesnakestealer_1 (yara-rule)
- SEKOIA_Infostealer_Win_Whitesnake_Xor_Rc4_July12 (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Whitesnake (report)
- news.drweb.com — Show (report)
- infinitumit.com.tr — White Snake Stealer Report (report)
- russianpanda.com — Whitesnake Stealer Malware Analysis (report)
- intezer.com — Babble Babble Babble Babble Babble Babble Babbleloader (report)
- bazaar.abuse.ch — 5066Eca9C7309Af16C882Ffae79Ceee93D5C8A8Bcfe3726455C9B5589A492553 (report)