CSJohnDoeProjectStealer

Also known as:John Doe Project banner stealer@JohnDoeProject system_info.txt slice

What is the CSJohnDoeProjectStealer infostealer, and what data does it steal?

CSJohnDoeProjectStealer (also known as John Doe Project banner stealer and @JohnDoeProject system_info.txt slice) is a CyStack research label for information-stealer traces. CSJohnDoeProjectStealer targets Host hardware and OS fingerprint (CPU, GPU, RAM, resolution, Windows version, .NET Runtime, CLR), Network identity (LAN IP, default gateway), Account identity (Windows username, computer name) and Full Windows Environment Variables dump. As of 11/10/2026, CyStack's research records 1 distribution channel, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSJohnDoeProjectStealer is a CyStack-coined identifier for a .NET-based stealer that self-identifies with the single-line banner John Doe Project [t.me/JohnDoeProject] at the top of its system_info.txt file. The body carries a flat bare-key Key: Value identity block with .NET-canonical fields (CLR Version:, .NET Runtime:, Processor Count:, System Directory:) plus host fingerprint (Computer Name, User Name, OS Version, System Version, Local IP, Default Gateway, Antivirus, CPU, GPU, RAM, SCREEN) and a trailing === ENVIRONMENT VARIABLES === section carrying a full KEY = value env-var dump.

The @JohnDoeProject Telegram channel and the panel banner are unattested in public reporting and community catalogues. The .NET-canonical field set is consistent with a private C#-based stealer template. Family attribution is provisional pending a published threat-intel mapping for this layout.

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence