Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSArhontHardwarePreambleStealer Malware Analysis

CSArhontHardwarePreambleStealer

Also known as:@ArhontCorp Information.txt hardware preambleBugatti Private Cloud 3-field hardware siblingCryptogoL (TG @ArhontCorp) capital-I Information.txt layout

What is the CSArhontHardwarePreambleStealer infostealer, and what data does it steal?

CSArhontHardwarePreambleStealer (also known as @ArhontCorp Information.txt hardware preamble, Bugatti Private Cloud 3-field hardware sibling and CryptogoL (TG @ArhontCorp) capital-I Information.txt layout) is a CyStack research label for information-stealer traces. CSArhontHardwarePreambleStealer targets Victim hardware preamble (CPU model, RAM capacity, GPU model). As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSArhontHardwarePreambleStealer is a CyStack-coined identifier for a stripped 3-field hardware preamble observed inside CryptogoL #<N> (TG @ArhontCorp).rar aggregator packs at <CC>_<Prefix>_<DD.MM.YYYY> (TG @ArhontCorp)/ Information.txt (capital-I filename) victim folder paths. The pack ships three per-victim files, each with a different stripped-content shape: an Info.txt containing a canonical Remus Stealer YAML body (handled under the Remus profile with the Bugatti Private Cloud panel-brand overlay), a lowercase information.txt carrying a 6-field identity preamble (handled under the CSArhontIdentityStealer profile), and this capital-I Information.txt carrying only three hardware fields.

Body fields: CPU (space-padded colon convention, 1-space leading indent), RAM (same convention), GPU (same convention). No system info, no network info, no credentials. The @ArhontCorp Telegram channel is attested as a Russian-speaking log-aggregator and reseller brand (HEROIC darkhive-breaches catalogue: Private Russia 34 TG ArhontCorp, KATANA CLOUD PRIVATE TG ArhontCorp, Slurm Private TG ArhontCorp, FateTraffic TG ArhontCloud). No published source attributes the stripped-hardware preamble shape to a specific builder.

Family attribution is provisional pending a published threat-intel mapping. During triage, treat this label as a "victim hardware preamble preserved under @ArhontCorp redistribution" marker: the CPU / RAM / GPU values still travel through the IOC and are usable for cross-sample pivoting even without an underlying family attribution. The companion Info.txt carries the Remus YAML body with full system / identity / anti-virus enumeration; the companion information.txt carries the 6-field identity preamble (MachineID / GUID / HWID triple).

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Panel name	Distribution channel	Confidence
bu********	Telegram	Unknown

Data is masked to protect the community

The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`111837e...`	1	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence