en
CSBuildBlockStealer is a CyStack research label for information-stealer traces. CSBuildBlockStealer targets browser credentials, cryptocurrency wallets and System hardware and locale inventory. As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSBuildBlockStealer is a CyStack-coined identifier for a
UserInformation.txt shape distributed via @ft7links
aggregator packs that the operator mislabels as redline. The
body is a flat key/value block whose distinguishing feature is
a four-line Build Path: / Build ID: / Build Version: /
Build Comment: group plus an Active window: line and a
two-letter GEO: country code. None of the canonical Redline
anchors (Operation System: typo, FileLocation:,
Hardwares: block, Anti-Viruses: block) appear, so the
aggregator label cannot be trusted.
Family attribution is provisional pending a published
threat-intel mapping for this layout. Public reporting and the
public stealer-format catalogues do not document a family
using this exact Build block plus Active window: plus
GEO: field set. Aurora ships Build ID paired with Build Group; RisePro ships Build and HWID only; Mystic Stealer
is documented at the protocol level rather than the
log-template level - none match.
1 distinct distribution channel recorded for this malware
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| Panel name | Distribution channel | Confidence |
|---|---|---|
| 4-******** | Telegram | Unknown |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
1 variant recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
bf1a41e... | 369 | Unknown |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
User time: <value>HWID: <value>PC Name: <value>User Name: <value>CPU: <value>GPU: <value>Memory: <value>OS: <value>Active window: <value>Build Path: <value>Build Version: <value>Build Comment: <value>Admin rights: <value>IP:
