CSTagBuildStealer is a CyStack-coined identifier for a
compact eleven-field Events/BROWSER/userinfo.txt panel
observed inside WATER CLOUD Telegram aggregator archives
(@WATERCLOUD_INFO <count> PIECE & <DD>.<MM>.<YYYY>.zip. <NN>) at <32-char>_<YYYY>-<MM>-<DD> <HH>-<MM>-<SS>/ Events/BROWSER/userinfo.txt victim folders. The panel
body carries only bare Key: Value lines with no leading
dash prefix, no section headers, no operator banner, and
no in-body watermark. Fields collected: Country (ISO-2),
RAM (GB-suffixed), CPU (bare integer core count, not
a model name), Monitors (integer count), AV (product
name plus parenthesised (ON) / (OFF) state suffix),
Elevation (Normal for non-elevated, Elevated / Admin
when observed), ID (8-char uppercase alphabetic short
identifier, not a GUID or MD5-hex HWID), IP, Version
(semantic version like 0.1.18), Tag (campaign or
affiliate label), and BuildID (Git-branch-like reference
like main).
The Events/BROWSER/ nested victim-folder path is
distinctive — no other panel in the surveyed corpus writes
its system-info file under a two-level Events/<Section>/
folder tree. The three-way Version + Tag + BuildID
build-metadata triple and the AV: <product>(<STATE>)
state-suffix syntax are equally novel to the surveyed
corpus.
No two curated CTI vendors document this exact
eleven-field compact shape. Aurora Stealer per eSentire
and
Sekoia ships a compact UserInformation file but uses
different field naming (Screen Size: / Display Device:
/ Build Group: / Log date:) and does not carry the
Events/BROWSER/ folder path or the Elevation: Normal /
AV: X(ON) markers, so attribution to Aurora would be a
mislabel. The WATER CLOUD aggregator resells logs from
multiple underlying builders, so the distribution channel
is recorded as attribution context rather than lineage.
