Observed-self-label profile for a Rivas Stealer system
report redistributed under the @VidarTraffics Telegram
aggregator inside @VidarTraffics <count> Mix Bonus <DD>-<MM>-<YYYY>.part<N>.rar packs at @VidarTraffics New Fresh Logs #<N>/Information.txt victim folders.
The body opens with a two-line = fence framing a centered
Rivas Stealer Report title, then three pipe-decorated
sections in fixed order: ---| User Info |---,
---| Hardware Info |---, ---| Network |---. The
User Info and Hardware Info blocks use padded
Key : Value grammar with the key left-justified to a
fixed 10-character column. Fields collected: Username,
PC Name, OS Version, HWID (Windows machine-GUID
literal in curly braces), CPU, GPU, RAM (GB-suffixed),
Screen (WIDTHxHEIGHT). The Network block is a bare
ordered list without keys carrying a canned geo-lookup
payload (status, country name, ISO country code, region
code, region name, city, postal code, latitude, longitude,
IANA timezone, ISP, ASN and AS-name, public IP).
The Rivas Stealer self-label names this profile but no
independent curated or community threat-intel writeup as
of integration establishes payload lineage. The pipe-decorated
section syntax and padded-key field grammar are not
documented in any surveyed canonical family. Family
attribution is preserved as the panel self-label with
unknown confidence; @VidarTraffics is a Telegram log-aggregator
reseller that repackages logs from multiple underlying
builders, so the distribution channel is recorded as
attribution context rather than lineage.
