Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSRoyCloudInfoStealer

Also known as:RoyCloud bare-KV Info.txt panelRÔýĆløud watermarked Redline-style Info.txt

What is the CSRoyCloudInfoStealer infostealer, and what data does it steal?

CSRoyCloudInfoStealer (also known as RoyCloud bare-KV Info.txt panel and RÔýĆløud watermarked Redline-style Info.txt) is a CyStack research label for information-stealer traces. CSRoyCloudInfoStealer targets Host metadata: hostname, NetBIOS, Windows username, language, OS fingerprint with build number and architecture, Hardware inventory: CPU model with cores/threads, GPU, installed RAM, Installed antivirus product name and Sample execution path and elevation flag. As of 11/10/2026, CyStack's research records 1 variant, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSRoyCloudInfoStealer is a CyStack-coined identifier for a bare Key: Value Info.txt panel associated with the RoyCloud reseller. The retained representative observation came from BONUS$#01(c)_NEW_ROYCLOUD_HQ_MIX_<n>_<Mon>_<YYYY>.part1.rar at a <CC>_<IPv4>-<HWID>/Info.txt victim path.

The sample starts with decorative ASCII art rendering ROYCLOUD and includes the distinctive stylised watermark RÔýĆløud; random alphanumeric text around that literal changes between observations. Its flat body records Build Date, Configuration, Execution Path, Elevated, Computer Name, User Name, User Language, Netbios, Operation System, Install Date, System Date, Time Zone, Antivirus, HWID, Processor, Processor Threads, Processor Cores, Graphics Card, Installed RAM, and Display Resolution. The Operation System spelling is retained exactly as observed.

Family attribution remains provisional. No independent public research currently maps the RoyCloud label to a canonical malware family. The body combines Redline-style verbose field names with Lumma-influenced vocabulary, while the same RÔýĆløud reseller watermark has also been observed around a Remus-format body.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`f4b3735...`	1	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Sample log format

1    Build Date: <value>2Configuration:3Execution Path: <value>4Elevated: <value>5Computer Name: <value>6User Name: <value>7User Language: <value>8Netbios: <value>9Operation System: <value>10Install Date: <value>11System Date: <value>12Time Zone: <value>13Antivirus: <value>14HWID: <value>15Processor: <value>16Processor Threads: <value>17Processor Cores: <value>18Graphics Card:19Installed RAM: <value>20Display Resolution: <value>

CSRoyCloudInfoStealer Infostealer Analysis: Targets & TTPs