CSSnatchCloudSigInfoStealer is a CyStack tracking name
for the @SNATCH_CLOUD reseller's space-stripped
Info.txt sig-info variant, shipped alongside the
reseller's Windows Redline UserInformation.txt and
macOS system_profiler Information.txt siblings inside
<DD.MM> @SNATCH_CLOUD <count>K.part<N>.rar aggregator
packs at <CC><32-char-token>_<ISO8601-with-spaces>/ Info.txt victim folders. The body carries the full
sig-info-canonical field vocabulary (BuildDate,
Configuration, ExecutionPath, Elevated,
ComputerName, UserName, UserLanguage, Netbios,
OperationSystem, InstallDate, SystemDate,
TimeZone, Antivirus, HWID 32-hex, Processor,
ProcessorThreads, ProcessorCores, GraphicsCard
section with indented GPU model, InstalledRAM,
DisplayResolution, IPAddress, Time:<DD.MM.YYYYHH: MM:SS>(sig:UNIX.HEX), Country, User), with every
inter-word space inside keys removed by the reseller
(Build Date: → BuildDate:, Processor Threads: →
ProcessorThreads:, Installed RAM: →
InstalledRAM:, IP Address: → IPAddress:) and
inter-token spaces inside values collapsed
(Jan 14 2026 → Jan142026, 19.10.2024 01:09:10 →
19.10.202401:09:10).
Family attribution preserves the CyStack-coined
sig-info family at low confidence: the underlying panel
builder has no curated-CTI mapping. The
(sig:UNIX.HEX) watermark on the Time: footer line
is documented as a Lumma-family artifact per
Cloudflare Cloudforce One, but the bare Key:Value field
set with Redline-style verbose naming does not match
Lumma's canonical dash-prefixed layout; attribution
stays low pending a curated mapping. HEROIC Threat
Intelligence documents @SNATCH_CLOUD as a dedicated
Telegram reseller releasing 18,561-record stealer-log
breach dumps, which the panel-brand overlay reflects.
