CSFateTrafficPyGrabberStealer is a CyStack-coined
identifier for a Python-based information.txt grabber
body redistributed inside @FATETRAFFIC aggregator packs
alongside the sibling CSFateTrafficInfoStealer
Redline-shape body. The victim folder shape mirrors the
sibling profile
([<CC>]_@FATETRAFFIC_<YYYY>_<MM>_<DD>_<N>/) but the
per-victim system-info file is named information.txt
(lowercase) and carries a bare 11-line Key: Value block
with a distinct Python-grabber field vocabulary rather
than the Redline-shape verbose keys.
Distinguishing observable features:
Processor: carries the verbatim output of Python's
platform.processor() on Windows (AMD64 Family <n> Model <n> Stepping <n>, <vendor> shape). Compiled
stealers (Redline, Lumma, Vidar, Stealc) enumerate CPUs
via WMI and emit either the branded model string or a
Win32_Processor.Name WMI value, never the raw
Family/Model/Stepping/Vendor tuple.Architecture: field emits Python's platform.machine()
value (AMD64 / x86 / ARM64). No compiled-stealer
body emits this field name.Public IP: and Local IP: distinguish network-scope of
the captured address; Python grabbers routinely combine
a public-IP GeoIP lookup with socket.gethostbyname (socket.gethostname()) local resolution.Country: <Name> (<ISO2>) parenthesised ISO alpha-2
form is the response shape of ipapi.co and
ip-api.com GeoIP APIs that Python grabbers wrap.Drives: comma-separated single-line drive list is the
os.listdir("//")-plus-os.path.exists scan pattern.Time: YYYY-MM-DD HH:MM:SS ISO wall-clock is
datetime.now().strftime("%Y-%m-%d %H:%M:%S").- No banner, no watermark, no Redline-shape
Operation System: typo, no Lumma dash-prefix, no Vidar
[Hardware] section.
The Python-grabber body shape has structural similarity
to multiple documented Python-based info-stealer families
(Blank Grabber and forks per ANY.RUN and Splunk; Inf0s3c
Stealer, XillenStealer, and Akira Stealer per CYFIRMA;
PXA Stealer per SentinelOne Labs) but no surveyed
curated CTI writeup quotes the exact field vocabulary
(Architecture: + Public IP: + Local IP: + Drives:
- parenthesised-ISO
Country:) this variant emits.
@FATETRAFFIC is documented by HEROIC and Brinztech as a
Telegram log-aggregator channel that resells mixed-source
stealer logs without naming underlying builders. Family
stays CyStack-coined with @FATETRAFFIC distribution
channel preserved as attribution context; rename the
profile if a published threat-intel mapping surfaces.
