en
CSTagRegionStealer is a CyStack research label for information-stealer traces. CSTagRegionStealer targets System hardware and geolocation fingerprint (CPU, GPU, RAM, screen resolution, OS, hostname, IP, region) and Credential artifacts in sibling files within the victim folder. As of 11/10/2026, CyStack's research assesses unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSTagRegionStealer is a CyStack-coined identifier for a
stripped 9-line system.txt panel whose most distinctive
feature is a mid-file key-spacing transition. The first five
fields use the tight Key: Value shape (Core:, Video:,
RAM:, Screen:, OS:), and the trailing four fields use
the loose Key : Value shape with a space before the colon
and all-lowercase key names (name :, tag :, ip :,
region :). The transition suggests a builder that
concatenates two separately-generated blocks: a hardware
inventory followed by an identity plus geolocation block.
The panel emits no ASCII-art banner and no watermark. The tag : field carries the operator affiliate or build identifier
when set (empty in the retained sample,
indicating a default no-tag build). The region : field
carries a slash-separated Country/Subdivision/City triple
with the full country name (not ISO 3166-1 alpha-2) as the
first token; the full-name country value should not be treated as an ISO country code.
Observed inside a generic <N MONTH> - <count> LOGS
aggregator archive with victim folders shaped as
[<IPv4>]<hostname>{<MachineGuid>}/system.txt. The aggregator
naming does not identify a specific Telegram channel.
Family attribution is provisional pending a published
threat-intel mapping for this layout. Public reporting and
community catalogues return no hits for the Core: / Video:
/ Screen: label combination or for the space-around-colon
lowercase tag : / region : pair. The CyStack tracking name can be revised when published evidence identifies the underlying builder.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
