WhiteSnake Stealer logs. Post-2024 builds emit a PC_info.txt
beginning with an emoji-prefixed 🖥Computer info: section and
containing the system, user, and time values together with
later sections covering installed software and network state.
Distributed via Telegram aggregator channels (BRADMAX-style
redistributors) and via a MaaS subscription model.
Also known as: WhiteSnake Stealer
Variants observed: 5
Top attribution confidence: high
- Browser saved credentials and cookies
- Crypto wallet extensions and desktop clients
- Discord, Telegram, Steam session data
- 2FA codes from authenticator apps
- Email and FTP client credentials
Attribution confidence: high
Field keys:
CPU, City, Country, GPU, IP, Installed antivirus, Internet provider, RAM, Region, Started as admin, System, System time, User name
Filenames: PC_info.txt
Sample (sanitized):
🖥Computer info:
System: Microsoft Windows 11 Home Single Language (x64)
User name: <redacted>
System time: 2025-11-19 <ip> PM
CPU: 11th Gen Intel(R) Core(TM) i5-11400H @ 2.70GHz
GPU: NVIDIA GeForce GTX 1650
RAM: 24355 MB
🛡Security:
Installed antivirus: Windows Defender, Norton Security Ultra.
Started as admin: True
📡Whois:
IP: <redacted>
Country: Argentina [AR]
City: <redacted>
Region: Corrientes
Internet provider: Corrientes Telecomunicaciones S.A.P.E.M
Attribution confidence: high
Field keys:
CPU, City, Computer name, Country, GPU, HWID, IP, Installed antivirus, Internet provider, RAM, Region, Started as admin, System, System time, User name
Filenames: PC_info.txt
Sample (sanitized):
🖥Computer info:
System: Microsoft Windows 11 Pro (x64)
Computer name: <redacted>
User name: <redacted>
System time: 2025-11-05 <ip> AM
CPU: Intel(R) Core(TM) i7-1065G7 CPU @ 1.30GHz
GPU: Radeon 620 Series
RAM: 16072 MB
HWID: <redacted>
🛡Security:
Installed antivirus: Windows Defender, ESET Security.
Started as admin: False
📡Whois:
IP: <redacted>
Country: Argentina [AR]
City: <redacted>
Region: Buenos Aires F.D.
Internet provider: SpaceX Starlink
Attribution confidence: high
Field keys:
CPU, Computer name, GPU, HWID, Installed antivirus, RAM, Started as admin, System, System time, User name
Filenames: PC_info.txt
Sample (sanitized):
🖥Computer info:
System: Microsoft Windows 10 Pro (x64)
Computer name: <redacted>
User name: <redacted>
System time: 2025-11-23 <ip> AM
CPU: Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz
GPU: Intel(R) HD Graphics 4000
RAM: 16302 MB
HWID: <redacted>
🛡Security:
Installed antivirus: Windows Defender.
Started as admin: False
📡Whois: Failed to fetch data
Attribution confidence: high
Field keys:
CPU, GPU, HWID, Installed antivirus, RAM, Started as admin, System, System time, User name
Filenames: PC_info.txt
Sample (sanitized):
🖥Computer info:
System: Microsoft Windows 11 Pro (x64)
User name: <redacted>
System time: 2025-10-13 <ip> PM
CPU: Intel(R) Core(TM) i7-1065G7 CPU @ 1.30GHz
GPU: Intel(R) Iris(R) Plus Graphics
RAM: 7946 MB
HWID: <redacted>
🛡Security:
Installed antivirus: Windows Defender, McAfee VirusScan, McAfee.
Started as admin: True
📡Whois: Failed to fetch data
Attribution confidence: high
Field keys:
CPU, City, Country, GPU, HWID, IP, Installed antivirus, Internet provider, RAM, Region, Started as admin, System, System time, User name
Filenames: PC_info.txt
Sample (sanitized):
🖥Computer info:
System: Microsoft Windows 11 Pro (x64)
User name: <redacted>
System time: 2026-01-19 <ip> PM
CPU: Intel(R) Core(TM) i5-1035G1 CPU @ 1.00GHz
GPU: Intel(R) UHD Graphics
RAM: 20257 MB
HWID: <redacted>
🛡Security:
Installed antivirus: Windows Defender.
Started as admin: True
📡Whois:
IP: <redacted>
Country: Colombia [CO]
City: <redacted>
Region: Norte de Santander Department
Internet provider: Telmex Colombia S.A.
The emoji-prefixed section header (🖥Computer info:) is
visually distinctive. Combined with User name: and
System time: field labels (note the spaces), this is
unambiguous WhiteSnake content.