en
CSBitArchStealer is a CyStack research label for information-stealer traces. CSBitArchStealer targets browser credentials and System hardware and locale inventory. As of 11/10/2026, CyStack's research records 1 variant, with unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSBitArchStealer is a CyStack-coined identifier for a
colon-no-space info.txt panel observed inside !! 2026 JAN.part01.rar aggregator packs distributed via Telegram log
channels. Per-victim folders follow a
<id>_<2-hex>_<ip>_<DD-MM-YY>/info.txt layout. The body is a
flat key/value block whose distinguishing markers are a
parenthesised BitArch:(x64 bit) architecture field and a
WindowsVersion: OS-name field, neither of which is used by
any other family in the catalog.
The panel writes literal Unknown country / Unknown city /
Unknown Region / Unknown IP / Unknown Timezone /
Unknown Zip placeholders when its IP-to-geo lookup fails.
Field-name semantics deviate from convention: the panel
appears to source Username from Windows USERDOMAIN
(workgroup label) and DomainName from the machine name, so
the values are essentially swapped relative to what the labels
suggest.
Family attribution is provisional pending a published
threat-intel mapping for this layout. Public reporting plus
public stealer-format catalogues do not document a family
using this exact field set. The CSBitArchStealer literal
preserves the panel's most distinctive marker as the suffix;
Update this tracking profile if a public writeup later
identifies the underlying builder.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
1 variant recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
969a798... | 49 | Unknown |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
Username:<value>DomainName:<value>Date:<value>GPU:<value>CPU:<value>RAM:<value>WindowsVersion:<value>BitArch:<value>Antivirus:<value>ScreenSize:<value>Country:<value>City:<value>Region:<value>IP:<value>TimeZone:<value>ZIP:<value>
