Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSTxtFilesPartStealer Infostealer Analysis: Targets & TTPs

CSTxtFilesPartStealer

Also known as:Arabic TXT Files Part Telegram manifestعدد الملفات file-count emoji panel

What is the CSTxtFilesPartStealer infostealer, and what data does it steal?

CSTxtFilesPartStealer (also known as Arabic TXT Files Part Telegram manifest and عدد الملفات file-count emoji panel) is a CyStack research label for information-stealer traces. CSTxtFilesPartStealer targets Victim public IP (in the `🌍 IP:` line), Per-victim harvested-file count (in the Arabic line) and Per-victim partition index (`Part <N>` in the header). As of 11/10/2026, CyStack's research records 1 variant, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSTxtFilesPartStealer is a CyStack-coined identifier for an Arabic-language Telegram-bot manifest panel that ships as a three-line Information.txt victim file. Observed inside !! 2025 JULY.part001.rar at [<CC>]<ip>/Information.txt victim files.

The body carries three emoji-prefixed lines: a 📁 TXT Files | Part <N> partition header, a 🌍 IP: <ipv4> victim public IP line, and a 📦 عدد الملفات: <count> Arabic file-count line. The Arabic literal عدد الملفات reads as Number of files and is the panel's developer-side label, indicating the operator is Arabic-speaking. The Part <N> suffix on the header is a per-victim upload-batch identifier the panel emits when it splits a larger pack across multiple partitions.

Family attribution is provisional pending a published threat-intel mapping for this layout. The general Telegram-bot exfiltration shape is broadly documented, but no public source ties the Arabic file-count literal and the TXT Files | Part <N> partition convention to a specific named family.

MITRE ATT&CK technique mapping

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`3d2b017...`	5	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence