Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSInfoNetworkSectionStealer

Also known as:Info_Network + Info_Software section stealerUnderscored-field _Info.txt stealer

What is the CSInfoNetworkSectionStealer infostealer, and what data does it steal?

CSInfoNetworkSectionStealer (also known as Info_Network + Info_Software section stealer and Underscored-field _Info.txt stealer) is a CyStack research label for information-stealer traces. CSInfoNetworkSectionStealer targets Host OS + hardware fingerprint (Windows version + build, CPU with core count, GPU, display resolution, language, IANA Olson timezone), Account identity (user + computer name from the paren-annotated ``UserName ( ComputerName )`` field), Geo enrichment (IP, country name + ISO code, city) and Installed software inventory (bracketed ``[Info_Software]`` section with per-program version tags). As of 11/10/2026, CyStack's research assesses unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSInfoNetworkSectionStealer is a CyStack-coined identifier for a heavily-padded fixed-width _Info.txt panel with underscored field names and [Info_Network] / [Info_Software] bracketed-underscore section headers. Observed inside the 25 APRIL - 25729 LOGS.part01.rar aggregator pack at <32-char>_<TIMESTAMP>/_Info.txt victim folders. The 2020-07-10 log timestamp on observed samples suggests an older builder whose panel-format research pre-dates current public reporting.

The emitter replaces spaces with underscores inside multi-word field keys (Local_Date_and_Time:, OS_Language:, Keyboard_Languages:, Display_Resolution:) and uses a paren-with-spaces annotation convention (UTC ( TimeZone ) :, UserName ( ComputerName ) :). The UTC ( TimeZone ) value packs a bare 4-digit hhmm offset alongside an IANA Olson timezone name (-0400 ( America/New_York )). Related to the CSStartBuildInfoStealer sibling by the shared _Info<...>.txt leading-underscore filename convention and paren-annotated UserName field, but the specific field-name spellings and bracketed-underscore section format make it a distinct panel-emit variant.

MITRE ATT&CK technique mapping

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Info_Network + Info_Software section stealer Malware Analysis