CSPlutusStealer is a CyStack-coined identifier for the
Plutus Stealer v 3.0 SystemInfo.txt panel. The malware
self-brands via a Figlet Plutus ASCII-art banner and a
bare Plutus Stealer v <MAJOR>.<MINOR> line, followed by
five uppercase bracket sections in fixed order: [GENERAL],
[LOCATION], [SYSTEM], [HARDWARE], [CLIPBOARD].
The [GENERAL] block carries a two-line Build Tag +
Build Version panel-versioning pair, a Machine Id
panel-issued victim identifier (two-letter panel prefix plus a
24-character alphanumeric tail), an Is running as admin
boolean flag, and a File Location path pointing at the
malware install location. The [LOCATION] block reports IP
plus a full geo-IP profile (Country, ISO, City, ZIP, Postal,
Time Zone with Olson name and UTC offset, Location with
European comma-decimal latitude / longitude). The
[HARDWARE] block ships a Windows registry MachineGuid
wrapped in curly braces under the HWID key, distinct from
the panel-issued Machine Id above. The [CLIPBOARD]
block captures the foreground clipboard contents at capture
time and can carry chat fragments and account-transfer
templates in the victim locale.
Family attribution is provisional pending a published
threat-intel mapping for this layout. Public reporting returns
no hits for a Plutus Stealer name paired with an
infostealer format. Community catalogues also carry no
attestation. The operator self-brand is preserved verbatim in
panel_brand but not trusted as an attribution mapping.
Update this tracking profile when a public writeup identifies
the underlying builder.
The single observed pack was delivered through the
@bugatti_cloud Telegram channel, a publicly catalogued
multi-family stealer-log aggregator. Sibling slices of the
same channel already carry DCRat, BracketSection, and
CyStack-coined variants; this Plutus-branded slice extends
that portfolio.
