CSGoRuntimeStealer is a CyStack-coined identifier for a bare
4-field system_info.txt panel observed inside !! 2025 DEC.part01.rar aggregator packs at
[<CC>]<IPv4>/<operator-handle>/system_info.txt victim
folders (e.g. [UN]<IPv4>/poopbandit/system_info.txt).
The body is a 5-line minimal panel: an ALL CAPS triple-equals
=== SYSTEM INFORMATION === section header, four flat
key-value lines (User: <Computer>\<Username> / Computer: /
OS: <goos> <goarch> / Directory:), and a closing
triple-equals rule.
The strongest single fingerprint is the OS: value: Go
binaries emit runtime.GOOS + " " + runtime.GOARCH which
produces strings like windows amd64, linux 386, or darwin arm64. The bare lowercase two-token shape does not appear in
any other surveyed stealer-builder runtime: .NET emits
Microsoft Windows <version>, Python emits
Windows-<release>-<build>, Lumma emits Windows <version> <edition> (<build>). The Go runtime shape is the panel's
clearest builder-attribution signal.
The User: line carries a <Computer>\<Username>
backslash-separated identity (the panel's preferred shape over
os/user.Current().Username which would return just the
username on Unix). The Directory: line carries the malware's
execution path; the observed sample ran out of %TEMP%. The
path-side <operator-handle>/ segment between the victim
folder and the system_info.txt file exposes the operator's
panel-side identifier (poopbandit in the observed sample);
the operator handle is retained as distribution-channel
evidence in this catalog.
Public reporting and the public stealer-format catalogues do
not document a family that emits exactly this minimal
Go-runtime panel shape. The poopbandit operator handle is
unattested. Family attribution is provisional pending a
published mapping.
