CSOneGoStealer is a CyStack-coined identifier for a flat
bare-key System.txt panel emitted by a Go-based stealer
binary. The body opens with IP: / Execute Path: / Build Name: / User Name: / Computer Name: / CPU: / GPU:
(repeated per adapter) / Operation System: / Country ISO2:
/ Elevated: / Screen Resolution: / Date: lines, then a
blank-line gap and a misspelled Enviromental Variables:
(sic) section dumping the victim's Win32 environment as
KEY=VALUE pairs. The observed Build Name value is the
literal One-Go, the operator's build / version label
hardcoded into the panel.
The Go-runtime signature is the Date: value: Go's default
time.Time.String() format with sub-second precision and a
trailing +0000 UTC token after the numeric offset
(2025-06-23 16:49:43.2152587 +0000 UTC). Python
datetime.isoformat, .NET, and Delphi all emit different
shapes, so the trailing UTC keyword pins the underlying
binary to a Go build. The misspelled Enviromental section
header (missing the first n) is a stable panel-side bug
hardcoded in the source.
Family attribution is provisional pending a published
threat-intel mapping for this layout. Public reporting,
including the Go-stealer writeups on Skuld, Salat Stealer,
Pentagon Stealer, macOS MetaStealer, and the 2019 Go-stealer
find, does not document a family that emits this exact field
set. Rename if a later report attributes the layout to a known
author.
