Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

LCID bracket stealer Malware Analysis: Targets & TTPs

CSLcidBracketStealer

Also known as:FATETRAFFIC LCID-bracket UserInformation.txtLCID bracket stealer

What is the CSLcidBracketStealer infostealer, and what data does it steal?

CSLcidBracketStealer (also known as FATETRAFFIC LCID-bracket UserInformation.txt and LCID bracket stealer) is a CyStack research label for information-stealer traces. CSLcidBracketStealer targets Host metadata: hostname, hashed user identity, OS build, Hardware inventory: CPU model with core count, installed RAM, Screen resolution, Windows locale and keyboard layout enumeration, Machine uptime at time of exfiltration, Sample execution path, Installed antivirus product summary and Victim public IP. As of 11/10/2026, CyStack's research records 1 variant, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSLcidBracketStealer is a CyStack-coined identifier for a compact plain Key: Value UserInformation.txt panel whose Language: field appends the Windows Locale ID hex code in square brackets (for example Language: English (United States) [0x0409]). Observed inside BONUS @FATETRAFFIC <count> MIX <DD>-<MM>-<YYYY>.part<N>.rar aggregator packs at [<CC>]_@FATETRAFFIC_<YYYY>_<MM>_<DD>_<N>/ UserInformation.txt victim folders (for example [US]_@FATETRAFFIC_2026_08_30_05503357/UserInformation.txt).

Body fields: Computer, User, IP, OS, CPU, RAM, Screen, Language, Keyboards, Uptime, Path, AV. The layout uses terse single-word keys throughout and packs the CPU core count inline in parentheses after the model string (CPU: Intel(R) Xeon(R) CPU @ 2.30GHz (2 cores)). The User value is a 16-character lowercase-hex identifier rather than the plain Windows account name emitted by every catalogued stealer family, suggesting the panel writes a hashed identity to obfuscate victim attribution. Uptime is reported in a compact minutes-only form (Uptime: 6 min) unlike the long-form Noxty phrasing catalogued by community indexes. AV reports a textual descriptor (AV: None detected) rather than a product-name list. Path records the sample execution path rather than the FileLocation: label Redline canonical uses.

Attribution is provisional. No curated CTI vendor writeup or community catalog surveyed at time of integration documents this exact combination of terse single-word keys, LCID-bracket Language trailer, Keyboards: field, compact Uptime: N min shape, textual AV: None detected descriptor, and 16-character lowercase-hex User: identifier under the UserInformation.txt filename. The archive-side @FATETRAFFIC handle is an aggregator label rather than a stealer builder.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`7d93bf3...`	1	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence