# WhiteSnake Stealer - .NET infostealer sold as MaaS, exfiltrating via Telegram, Tor and HTTP

> WhiteSnake is a cross-platform (.NET Windows / Python Linux) information stealer sold as Malware-as-a-Service on underground forums since February 2023. It steals browser credentials and cookies, cryptocurrency wallets and extensions, FTP and messaging data and screenshots, and exfiltrates to attacker-controlled Telegram bots, an HTTP endpoint or a Tor hidden service.

- **Published:** 2026-10-19T07:42:00Z
- **Last reviewed:** 2026-10-19T07:42:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3863
- **ID:** TL-2026-3863
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

WhiteSnake Stealer was first observed in early February 2023 and advertised on underground forums as MaaS at $120/month, $900/year or $1,500 lifetime. The Windows build is a .NET (C#) executable; a Linux variant is a Python script. Cyble's initial report (24 Feb 2023) and FortiGuard's threat signal (28 Feb 2023) describe theft from Chromium-based browsers, Firefox and Edge, applications such as Steam and Telegram, cryptocurrency wallets and wallet browser extensions, with exfiltration to attacker-controlled Telegram bots. FortiGuard noted samples disguised as fake PDFs and children's games.

Cyberthint's April 2023 analysis of WhiteSnake.exe (29,196 bytes, SHA-256 a4191e00...fe9db7) documents a single-instance mutex (Iismnquexvzadgcnmtdldq), a string deobfuscation routine, WMI-based VM detection (SELECT * FROM Win32_ComputerSystem), registry and system fingerprinting, external-IP lookup via ip-api.com, screenshot capture and collection of browser credentials and session cookies, wallets, FTP client credentials and messaging application accounts. Stolen data is serialized as XML, encrypted and delivered to a Telegram bot via api.telegram.com (149.154.167.220). A Discord CDN URL hosting build.bat was listed as a malicious URL. The sample was detected by 58/70 VirusTotal engines at the time.

JFrog (April 2023) found 22 malicious PyPI packages published 14-23 April 2023 that delivered WhiteSnake through setup.py: the dropper identified the OS and executed Base64-decoded platform-specific payloads - the WhiteSnake RAT/stealer on Windows and a Python stealer on Linux. The Windows payload blacklists VM vendors (VMware, VirtualBox, KVM, Hyper-V), checks Debugger.IsAttached and loaded modules (SbieDll.dll, HTTPDebuggerBrowser.dll, FiddlerCore4.dll), XOR-obfuscates strings, copies itself to %localappdata%\NET.Framework and persists via a scheduled task running every minute. It downloads the Tor binary, writes a custom torrc with a random SOCKSPort (2000-7000) and exposes a hidden service supporting PING, UNINSTALL, REFRESH, SCREENSHOT, GET_FILE and LOADER commands. Collected data (XML, gzip, RC4 and optionally RSA) covers screenshots, hardware, processes and loaded assemblies, plus wallets (Atomic, Wasabi, Electrum, Metamask). The Linux payload uses ip-api.com, steals Firefox/Thunderbird credentials, Exodus/Electrum wallets and Telegram/Pidgin data, and posts an RC4-encrypted archive to the Telegram API.

SonicWall (18 Mar 2024) analysed a later variant with string decryption removed (far less obfuscation), adding keylogging, clipboard capture, microphone/webcam capture, Wi-Fi credential harvesting, a remote terminal, and 12+ wallets and crypto extensions (Ledger, Exodus, Monero, Metamask, Phantom, Ronin, BinanceChain, TronLink). It exfiltrates via an HTTP PUT to 45.61.137.41:8080/sendData with Base64 victim metadata and via a Telegram bot. Optional (default-off) persistence copies the binary to %AppData%\Local\RobloxSecurity\ and creates a scheduled task named WhiteSnake_Stealer running every minute; anti-VM is also default-off. Output reports are named [5 random chars]_username@computername_report.wsr.

No CVE, CVSS or actor attribution is stated in the sources; the malware is operated by multiple customers of the MaaS. Severity is analyst judgment. Note that api.telegram.com/149.154.167.220 and ip-api.com are legitimate services abused by the malware; block or alert on them only in context. A BeaconBeagle lookup for 45.61.137.41 and 149.154.167.220 returned HTTP 404 (no record).

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1059.006 Python
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1056.001 Keylogging
- T1012 Query Registry
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1113 Screen Capture

## Sources

- [Malware Analysis: WhiteSnake Stealer (Cyberthint)](https://cyberthint.io/malware-analysis-whitesnake-stealer/)
- [New .NET Malware "WhiteSnake" Targets Python Developers, Uses Tor for C&C Communication (JFrog)](https://jfrog.com/blog/new-malware-targets-python-developers-uses-tor-for-c2-communication)
- [WhiteSnake Stealer: Unveiling the Latest Version - Less Obfuscated, More Dangerous (SonicWall)](https://www.sonicwall.com/blog/whitesnake-stealer-unveiling-the-latest-version-less-obfuscated-more-dangerous)
- [New WhiteSnake Infostealer Sold in Underground (FortiGuard Threat Signal)](https://fortiguard.fortinet.com/threat-signal-report/5036)
- [New WhiteSnake Stealer Offered for Sale via MaaS Model (Cyble)](https://cyble.com/blog/new-whitesnake-stealer-offered-for-sale-via-maas-model/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3863