CSHostHwidStealer is a CyStack-coined identifier for a
plain Key: Value UserInfo.txt panel whose HWID field
carries a compound <8-hex>-<HOSTNAME> identifier that
embeds the Windows hostname into the second half of the
HWID. Observed inside BONUS @FATETRAFFIC <count> MIX <DD>-<MM>-<YYYY>.part<N>.rar aggregator packs at
[<CC>]_@FATETRAFFIC_<YYYY>_<MM>_<DD>_<N>/UserInfo.txt
victim folders (for example
[EG]_@FATETRAFFIC_2026_08_30_62434557/UserInfo.txt).
Body fields: IP, Country, City, ISP, HWID, OS,
Username, Hostname, Language, CPU Cores, RAM,
Disk, Display, followed by a --- Installed Software --- triple-dash section header and 2-space-indented
program names one per line (WMI-derived DisplayName strings
from the standard HKLM\Software\Microsoft\Windows\ CurrentVersion\Uninstall registry hive). The layout is
plain (no leading-dash prefix unlike Lumma and its Deimos /
BABA / AL variants), lacks the Redline-canonical
Operation System: typo and FileLocation: / Build ID:
anchors, is not YAML (unlike Remus), and does not carry
the Meduza UserInfo.txt layout markers or the plain hex
or GUID HWID hashes emitted by Redline, Lumma, Vidar,
Rhadamanthys, StealC, RisePro, Meduza, Acreed, and
MetaStealer.
Attribution is provisional. No curated CTI vendor writeup
or community catalog surveyed at time of integration
documents this exact combination of UserInfo.txt filename,
<hex>-<HOSTNAME> compound-HWID shape, --- Installed Software --- triple-dash section header, and indented
software-inventory bullet layout. The archive-side
@FATETRAFFIC handle is an aggregator label documented as
a mixed-source redistributor rather than a stealer builder.
