CSJohnsHubStealer

Also known as:JOHN GOT RIPPED banner stealer@johns_hub UserInfo.txt slice

What is the CSJohnsHubStealer infostealer, and what data does it steal?

CSJohnsHubStealer (also known as JOHN GOT RIPPED banner stealer and @johns_hub UserInfo.txt slice) is a CyStack research label for information-stealer traces. CSJohnsHubStealer targets Host hardware and OS fingerprint (CPU, GPU, RAM, resolution, Windows version, HWID), Network identity (IP, country, language) and Account identity (Windows username). As of 11/10/2026, CyStack's research records 1 distribution channel, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSJohnsHubStealer is a CyStack-coined identifier for a stealer that self-identifies with the JOHN GOT RIPPED Figlet ASCII-art banner and the https://t.me/johns_hub Telegram channel URL. The panel writes a flat bare-key UserInfo.txt body with 12 identity fields: Build: @johns_hub (self-referencing tag), Stealer version: <N.N.N> self-declared version, plus Country, IP, HWID (32-character uppercase hex), Username, OS, Language, CPU, GPU, RAM, Resolution, and a US-format Date: timestamp.

The @johns_hub channel and JOHN GOT RIPPED banner are not documented in any public reporting or community catalog. The flat field set is consistent with a generic .NET stealer template that could be a new family, a rebrand of an existing one, or a private-panel build. Family attribution is provisional pending a published threat-intel mapping for this layout.

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence