Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSExePathInfoStealer

Also known as:EXE_PATH header stealerOperating system + Memory ram spelling variant

What is the CSExePathInfoStealer infostealer, and what data does it steal?

CSExePathInfoStealer (also known as EXE_PATH header stealer and Operating system + Memory ram spelling variant) is a CyStack research label for information-stealer traces. CSExePathInfoStealer targets Host OS and hardware fingerprint (Windows version + build, CPU with lowercase-cores count, GPU with lowercase-second-word Video card key, RAM, display resolution, language), Account identity (user + computer name from the tight-parens ``Username (Computername)`` field), Harvester install path (``EXE_PATH:`` value points to the random-name .com dropped in a TMP IXP subdir) and Installed software inventory (bracketed ``[Software]`` section with per-program version tags). As of 11/10/2026, CyStack's research assesses unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSExePathInfoStealer is a CyStack-coined identifier for a heavily-padded fixed-width system_info.txt panel with the distinctive EXE_PATH: uppercase-underscore header field. Observed inside the 5,6 APRIL - 10250 LOGS.part1.rar aggregator pack at <32-char>_<TIMESTAMP>/system_info.txt victim folders where the archive-name convention with comma-separated dates mirrors CSStartBuildInfoStealer (4,5 MAY).

Third variant of a common panel-builder family sharing the paren-annotated UserName / Username and heavy column-alignment style with CSStartBuildInfoStealer and CSInfoNetworkSectionStealer, but each variant emits a distinct field-key spelling convention. This variant uses Operating system: (verbose lowercase-after-first-word), Memory ram: (lowercase-r ram), Video card: (spaced), Username (Computername): (tight parens lowercase-c), and a single [Software] bracketed section.

The 2021-01-19 log timestamp on observed samples suggests an older builder whose panel-format research pre-dates current public reporting. Family attribution is provisional pending a published threat-intel mapping.

MITRE ATT&CK technique mapping

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

EXE_PATH header stealer Malware Analysis: Targets & TTPs