WhiteSnake | Threat Level: high | Type: Infostealer

Cryptographic Identifiers

SHA256c219beaecc91df9265574eea6e9d866c224549b7f41cdda7e85015f4ae99b7c7
MD5a65e9165a47ed2cd2f168bf71db4181e
File Typeexe
Size490.0 KB
First Seen2023-05-22
File Namesnake.exe
Tagsexe, GurcuStealer, Whitesnake

Malware Family: WhiteSnake

WhiteSnake, Python stealer'dır.

TypeInfostealer
Programming LanguagePython
Target PlatformWindows
C2 ProtocolHTTP
PurposePython stealer
First Seen Year2023

Threat Indicators (IOC)

  • SHA256: c219beaecc91df9265574eea6e9d866c224549b7f41cdda7e85015f4ae99b7c7
  • MD5: a65e9165a47ed2cd2f168bf71db4181e

You can verify all hash values of this sample on VirusTotal.

System Cleanup Guide

  1. Disconnect the system from the network immediately
  2. Yeni bir cihazdan banka hesabı, sosyal medya ve e-posta şifrelerini değiştirin
  3. Move crypto wallets to a new address and abandon the old ones
  4. Start a full scan with up-to-date antivirus
  5. Clear saved browser passwords and enable 2FA
  6. Sign out of all sessions on every affected service

YARA Rule Hints

rule WhiteSnake_SHA256 {
    meta:
        description = "WhiteSnake sample: c219beaecc91df92"
        threat_level = "high"
        first_seen = "2023-05-22"
    condition:
        hash.sha256(0, filesize) == "c219beaecc91df9265574eea6e9d866c224549b7f41cdda7e85015f4ae99b7c7"
}

WhiteSnake — Malware Profile

WhiteSnake, Python ile geliştirildi.

Malware Type
Infostealer
Programming Language
Python
C2 Protocol
HTTP
Target Systems
Windows

Technical Details

C#/.NET, HTTP/gRPC C2 destegi, browser stealer, kripto wallet scraper, Telegram/Discord token stealer, Exodus/Atomic wallet stealer, clipboard hijacker, anti-VM

Capabilities & Behavior

Tarayıcı Kimlik Bilgileri
Çerez Hırsızlığı
Kripto Cüzdan Çalma
Sistem Bilgisi
Ekran Görüntüsü
FTP/SSH İstemci Şifreleri
E-posta İstemcisi Çalma
Veri Sızıntısı

IOC List (2 indicators)

IOC — WhiteSnake
# SHA256 c219beaecc91df9265574eea6e9d866c224549b7f41cdda7e85015f4ae99b7c7 # MD5 a65e9165a47ed2cd2f168bf71db4181e
TypeValueNote
sha256 c219beaecc91df9265574eea6e9d866c224549b7f41cdda7e85015f4ae99b7c7 Sample:WhiteSnake
md5 a65e9165a47ed2cd2f168bf71db4181e Sample:WhiteSnake

C2 Servers (2 recorded servers for this family)

Address Type Port Protocol Status Country
193.233.134.74 ip 8080 HTTP inactive RU
185.220.101.46 ip 80 HTTP sinkholed DE

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.

Tags
whitesnakeinfostealermalwarehighsha256hash-analizi