Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSBugattiCloudPcInfoStealer Malware Analysis

CSBugattiCloudPcInfoStealer

Also known as:@Bugatti_Cloud normalized pc_info.txt sliceBugatti Cloud JSON-null Local Time variant

What is the CSBugattiCloudPcInfoStealer infostealer, and what data does it steal?

CSBugattiCloudPcInfoStealer (also known as @Bugatti_Cloud normalized pc_info.txt slice and Bugatti Cloud JSON-null Local Time variant) is a CyStack research label for information-stealer traces. CSBugattiCloudPcInfoStealer targets Network identity (IP address, ISO 3166-1 alpha-2 country code), Account identity (Windows username, computer name, MachineGuid concatenated into the HWID value) and Host hardware summary (OS name, architecture, core count, RAM in gigabytes, screen resolution, GPU adapter list). As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSBugattiCloudPcInfoStealer is a CyStack-coined identifier for the @Bugatti_Cloud Telegram aggregator's normalized pc_info.txt slice. The body is a flat 13-field Key: Value block: IP, Country, HWID, OS, Architecture, UserName, Computer Name, Local Time, Cores, RAM, an empty Display Resolution, a populated top-level Resolution, and a GPU header with a tab-indented adapter list. The Local Time field carries the lowercase JSON-null literal null when the value is unset.

Two normalizer-side signatures point to a Python or Node.js operator tool rather than a native stealer panel. First, the HWID value glues the host's Computer Name (verbatim, including the Windows-default DESKTOP- prefix) to the host's MachineGuid UUID with no separator, a Python f-string concatenation shape. Second, the Local Time: null literal matches json.dumps(None) rather than any canonical stealer's empty value or Unknown fallback string. Family attribution is provisional pending a published threat-intel mapping for this layout; public reporting and community catalogues document @Bugatti_Cloud only as a redistribution channel, never as a native stealer family.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Panel name	Distribution channel	Confidence
bu********	Telegram	Unknown

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`eb652dc...`	1	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Sample log format

1⭐️HUNTER CLOUD PRICES :2 3🌧 Payment Method: <value>4 5⚡Join: <value>6 7🏪 Support: <value>8 9IP: <value>10Country: <value>11HWID: <value>12OS: <value>13Architecture: <value>14UserName: <value>15Computer Name: <value>16Local Time: <value>17Cores: <value>18RAM: <value>19Display Resolution:20Resolution: <value>21GPU:

CSBugattiCloudPcInfoStealer

What is the CSBugattiCloudPcInfoStealer infostealer, and what data does it steal?

Description

Accelerate investigation with professional monitoring solutions

Operator panels & distribution channels

Data is masked to protect the community

MITRE ATT&CK technique mapping

Variants (1)

Data limited to 5 variants

Common field keys

Sample log format