CSFateTrafficInfoStealer is a CyStack-coined identifier for
a banner-stripped bare Key: Value Info.txt panel
redistributed under the @FATETRAFFIC Telegram aggregator.
Observed inside BONUS @FATETRAFFIC <count> MIX <DD>-<MM>-<YYYY>.part<N>.rar packs at
[<CC>]_@FATETRAFFIC_<YYYY>_<MM>_<DD>_<N>/Info.txt victim
folders.
Body fields: Build Date (C-preprocessor __DATE__ shape),
Configuration (usually empty), Execution Path,
Elevated, Computer Name, User Name, User Language,
Netbios, Operation System (sic typo carried from Redline
/ Lumma sources), Install Date, System Date, Time Zone,
Antivirus, HWID, Processor, Processor Threads,
Processor Cores, Graphics Card, Installed RAM,
Display Resolution. The body is flat (no leading-dash
prefix unlike Lumma / Deimos / BABA), no FileLocation: /
Build ID: (unlike canonical Redline), and not YAML (unlike
Remus). No in-body panel banner, no (sig:UNIX.HEX)
Lumma-canonical watermark, no RÔýĆløud wrapper, no
@forza_traffic banner. Victim IP / country / HWID are
moved into the archive-path token rather than a trailing
body footer.
Body vocabulary is byte-identical to the sibling bare-KV
shapes attributed to CSSigInfoStealer, CSRoyCloudInfoStealer,
and CSForzaTrafficStealer, indicating the four aggregators
redistribute logs from a single underlying builder. No
curated CTI writeup published as of integration maps this
exact bare-KV Info.txt shape to a named canonical family.
HEROIC and Brinztech index @FATETRAFFIC as a Telegram
log-aggregator channel that resells mixed-source stealer
logs without attributing an underlying builder, so the
CyStack-coined name is preserved with the @FATETRAFFIC
distribution channel recorded as attribution context.
