Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSStartBuildInfoStealer

Also known as:Start Build Information.txt stealerColumn-aligned nslookup.exe process-hollow stealer

What is the CSStartBuildInfoStealer infostealer, and what data does it steal?

CSStartBuildInfoStealer (also known as Start Build Information.txt stealer and Column-aligned nslookup.exe process-hollow stealer) is a CyStack research label for information-stealer traces. CSStartBuildInfoStealer targets Host OS + hardware fingerprint (Windows version + build, CPU with core count, GPU, RAM, resolution, language, timezone offset), Account identity (user name + computer name from the paren-annotated ``UserName (ComputerName)`` field) and Installed software inventory (bracketed ``[Installed software]`` section with per-program version tags). As of 11/10/2026, CyStack's research assesses unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSStartBuildInfoStealer is a CyStack-coined identifier for a fixed-width column-aligned _Information.txt panel observed inside the 4,5 MAY - 5433 LOGS2.part1.rar aggregator pack at [<CC>][<HWID>]/_Information.txt victim folders. The panel uses a distinctive Start Build: first-line field whose value is the harvester's running executable path (typically C:\WINDOWS\SysWOW64\nslookup.exe when the stealer process-hollowed into a Windows built-in), followed by fixed-width column-aligned key/value pairs where every value starts at column 25.

Distinctive fields include UserName (ComputerName): with a paren-annotated <user> (<hostname>) value, Total RAM: with the Total prefix, CPU: with a parenthesised (Cores: N) suffix, Display Resolution: with spaces around the x, UTC: as a bare 4-digit hhmm offset without colon, and a bracketed [Installed software] section header followed by a free-form program-list body. The 2020-12-17 log timestamp on observed samples suggests an older builder whose panel-format research pre-dates current public reporting. Family attribution is provisional pending a published threat-intel mapping.

MITRE ATT&CK technique mapping

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Start Build Information.txt stealer Malware Analysis