Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Dash-section Info-tagged stealer Malware Analysis

CSTaggedInfoStealer

Also known as:Dash-section Info-tagged stealer- IP Info - / - PC Info - sectioned Information.txt

What is the CSTaggedInfoStealer infostealer, and what data does it steal?

CSTaggedInfoStealer (also known as Dash-section Info-tagged stealer and - IP Info - / - PC Info - sectioned Information.txt) is a CyStack research label for information-stealer traces. CSTaggedInfoStealer targets browser credentials, Discord session tokens, Host fingerprint (CPU, GPU with embedded resolution, HWID, OS, current language, admin flag) and Geo enrichment (IP, country, city, postal code, ISP with autonomous system number, timezone offset). As of 11/10/2026, CyStack's research records 1 variant, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSTaggedInfoStealer is a CyStack-coined identifier for a sectioned Information.txt panel observed inside the 17-20 AUGUST - 23791 LOGS.part01.rar aggregator pack. The panel uses - IP Info - / - PC Info - / - Other Info - / - Log Info - dash-bordered section headers, a Redline-derivative body vocabulary (FileLocation:, Current Language:, Is Elevated:, HWID: in 22-character alphanumeric shape), Cthulhu-derived geo fields (Postal:, ISP: with trailing - A<ASN> autonomous system suffix), and a distinctive credential-categorization block: Tags Passwords: with comma-separated category tags (SOCIAL, CRYPTO, SENSITIVE), Tagged URLs:, and Tagged Cookies:.

The sectioned layout plus the tag-category block are unattested in public reporting and community catalogues. The categorization scheme resembles StealC panel-side markers described in public ACR Stealer research, but the log-side output shape does not match StealC's canonical Network Info: + System Summary: layout. Family attribution is provisional pending a published mapping.

MITRE ATT&CK technique mapping

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`d522c2e...`	30	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Sample log format

1IP: <value>2Country: <value>3City: <value>4Postal: <value>5ISP: <value>6Timezone: <value>7 8Username: <value>9OS: <value>10CPU: <value>11GPU: <value>12HWID: <value>13Current Language: <value>14FileLocation: <value>15Is Elevated: <value>16 17Antivirus:18 19Build:<value>20 21Passwords: <value>22Cookies: <value>23Wallets: <value>24Files: <value>25Credit Cards: <value>26Servers FTP/SSH: <value>27Discord Tokens: <value>28 29Tagged URLs: <value>30Tagged Cookies: <value>31 32Tags Passwords: <value>33 34Tags Cookies: