CSWaterCloudInfoStealer is a CyStack-coined identifier for
a five-bracket-section Information.txt panel redistributed
under the WATER CLOUD Telegram aggregator. Observed inside
WATERCLOUD_INFO_<count>_FILES_<DD>_<MM>_<YYYY>_THANKS_FOR_ SUB_part<N>.rar archives at <32-char>_<YYYY>-<MM>-<DD> <HH>-<MM>-<SS>/Information.txt victim folders.
The body has five bracket-section headers in fixed order:
[Location], [General], [Hardwares] (plural), [Anti-Viruses]
(hyphenated plural), and [Build]. Each section carries
plain Key: Value fields with no leading dash prefix and no
operator banner block. Fields collected: IP, Country
(ISO-2), City, Zip under [Location]; Username,
Compname (short form), System, Language (country-flag
emoji + BCP-47 locale), Framework (.NET Framework minimum
version like >= 4.8), Date (mixed 24-hour + AM/PM
rendering) under [General]; CPU, GPU, RAM, SCREEN
(uppercase) under [Hardwares]; product-name-per-line list
under [Anti-Viruses]; Version and base64 ID under
[Build].
The hyphenated plural [Anti-Viruses] marker and the terse
Compname: / SCREEN: (uppercase) / Framework: field
names distinguish this format from other bracket-section
families in the surveyed corpus. Canonical Stealerium per
Proofpoint and Malpedia uses an emoji-section Markdown-bold
layout with a Stealerium - Report: banner rather than
square-bracket section headers, so attribution to canonical
Stealerium would be a mislabel despite the shared Compname
and SCREEN field names noted in the MalBeacon
what-is-this-stealer catalog. The WATER CLOUD aggregator
resells logs
from multiple underlying builders (per the sibling
Lumma-body WATER CLOUD variant), so the distribution channel
is recorded as attribution context rather than lineage.
