CSStealerCloudInfoStealer is a CyStack-coined
identifier for the STEALERCLOUD brokers third file shape: a stripped 2-field Information.txtcontaining just aGPU:line and aDisplays:(plural) line with multi-space value padding after each colon. The body carries no banner, no operator handle, and no other fields. SameSTEALERCLOUDpanel brand and@STEALERBOSS` distribution channel as
CSHardwareTailStealer (Info.txt YAML hardware tail)
and CSStealerCloudUserInfoStealer (UserInformation.txt
locale + geo block); the broker ships per-victim
context split across three filename shapes.
The stripped 2-field form likely reflects a fallback
path the broker takes when no canonical source-stealer
panel was available, falling back to a bare Win32
WMI Win32_VideoController + Win32_DisplayMonitor
enumeration. Family attribution is provisional pending
a curated CTI report.
Variants observed: 1
Top attribution confidence: low
Operator panel brands: STEALERCLOUD
Distribution channels: @STEALERBOSS
- Victim GPU model (from WMI
Win32_VideoController) - Victim display resolution (from WMI
Win32_DisplayMonitor)
Fingerprint id: stealercloud
Distribution channel: @STEALERBOSS
Attribution confidence: low
Field keys:
Build ID, CPU, Category, Computer, Cores/Threads, Country, Displays, GPU, HWID, IP, Keyboards, Language, Local Time, OS, Path, RAM, Reserve link, System, Timezone, UTC Time, Username
Filenames: Information.txt
Sample (sanitized):
GPU: NVIDIA GeForce GTX 1060 with Max-Q Design
Displays: 1920x1080
The line-anchored GPU: plus line-anchored Displays:
(plural) fingerprint is unique across the registry. The
plural Displays: form rules out sibling panels that
emit singular Display: or Display Resolution:. Pair
this label with CSHardwareTailStealer Info.txt and
CSStealerCloudUserInfoStealer UserInformation.txt files
in the same STEALERCLOUD#<NN> victim folder for the
full per-victim summary.
- @STEALERBOSS