Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSCrownBuildStealer Infostealer Analysis: Targets & TTPs

CSCrownBuildStealer

Also known as:

What is the CSCrownBuildStealer infostealer, and what data does it steal?

CSCrownBuildStealer is a CyStack research label for information-stealer traces. CSCrownBuildStealer targets browser credentials, cryptocurrency wallets and Application-data presence flag (`Applications:`). As of 11/10/2026, CyStack's research records 1 variant, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSCrownBuildStealer is a CyStack-coined identifier for a six-line Information.txt Telegram-bot caption observed inside !! 2025 JULY.part001.rar aggregator packs under [<CC>]<IPv4>/Information.txt victim folders. The panel is a compact preview summary - one field per line, each line opens with an emoji glyph attached directly to the ASCII key with no separator space (🚩IP:, 👑Build:, 🔑Passwords:, 🍪Cookies:, 💰Wallets:, 📂Applications:). The zero-space form is the panel quirk that distinguishes this layout from other emoji-prefixed formats.

The IP line carries a trailing (<CC>) two-letter ISO country code in parentheses after the IPv4. The Build line carries an operator-set build / affiliate label (STEAM in the observed sample, but the slot accepts arbitrary literals). The Wallets line names a single wallet brand (MetaMask) rather than emitting a count. The Applications line uses a literal No No / No placeholder when the empty-bucket sentinel applies.

Family attribution is provisional pending a published threat-intel mapping for this layout. Public reporting and the public stealer-format catalogues do not document a family that emits this exact six-line zero-space emoji-key shape with the country-code-in-parens IP convention and the Build: operator label slot.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`eae1f95...`	247	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence