White Snake – APT spyware

🔹 Windows stub features🔹

File loader.
Leaves no trace.
Strong log encryption.
Doesn’t requires server.
Fast execution in memory.
You able to install beacon into victim PC for remote access.
Functionality can be extended by editing grabber commands tab in builder.

Apps collection:

Firefox, Chrome, Chromium, Edge, Brave, Vivaldi, CocCoc, CentBrowser, Thunderbird, OBS-Studio, FileZilla, Snowflake-SSH, Steam, Signal, Telegram, Discord, Pidgin, Authy, WinAuth, Outlook, Foxmail, The Bat!, CoreFTP, WinSCP, AzireVPN, WindscribeVPN.

Wallets:

Atomic, Wasabi, Exodus, Binance, Jaxx, Zcash, Electrum-LTC, Guarda, Coinomi, BitcoinCore, Electrum, Metamask, Ronin, BinanceChain, TronLink, Phantom.

Payload available extensions list: EXE, SCR, COM, CMD, BAT, VBS, PIF, WSF, hta, MSI, PY, DOC, DOCM, XLS, XLL, XLSM.

🐧 Linux stub features 🐧

Apps collection:

Firefox, Exodus, Electrum, FileZilla, Thunderbird, Pidgin, Telegram.

File size: ~5kb
Coding language: Python
PY and SH output extensions available.

🧬 Panel features 🧬

👷 Builder

In builder you can generate payload.

You need to set telegram bot token and chat id.

Use @BotFather to create new bot and @chatIDrobot to receive your chatid.

Don’t forget to write /start command to initialize it.

You can select execution method (Non-resident or Resident)

Non-Resident stub will steal data and self-destruct.

Resident stub will steal data and you will be able to control victim PC later.

Builder can generate python library and automatically upload to PyPi.

Malicious library can be injected into any legit project or python file, it works on windows and linux.

You can set fake digital signature.
File size pumper.

🔖 Report page

💻 Basic information tab

Contains system info and desktop screenshot.

🤖 Automatic actions tab

Contains scripts which panel can do to save your time.

Here is full list:

Find proxies – Will try to find free SOCKS5 proxies from victim country.

Ronin/Metamask – You can bruteforce this wallets and extract mnemonic phrase.

Steam – You can view victim’s steam profile.

Telegram – Will open victim’s telegram session. If it has local passcode – will ask for passwords list to bruteforce.

<Browser> / <Profile> – Will open browser with victim’s cookies, spoofed User-Agents also you can use SOCKS5 proxy.

FTP <Host> – Will connect to ftp server.

Discord – Will open browser and import discord token to access account.

🔑 Passwords tab

This tab contains passwords from all browsers and several apps like filezilla hosts, pidgin and etc.

You can export unique passwords to generate bruteforce list.

Also you can search entries by domain name.

💳 Credit Cards and AutoFill tabs (Description not needed.)

🍪 Cookies tab

Contains cookies from all detected browsers, you can export them into Netscape or Json format.

📂 Grabber tab

Contains stolen files. For example wallets, apps sessions and etc.

🐚 Remote Terminal tab

Appears only if you have enabled “Resident” mode in builder.

If victim’s PC is online – green dot will blink near “Remote terminal” caption.

You can execute system commands, download and run files, refresh report (run stealer again), do desktop screenshots, webcam screenshot download files from PC.