Stealer Fingerprints
June 9, 2026 ยท View on GitHub
Public catalog of malware-family fingerprints curated by CyStack threat intelligence. Each entry documents a stealer log family with its banner strings, field signatures, sanitized sample, and ready-to-use YARA rules.
Each row in the table below summarises the operator-rebrand footprint observed for that family: how many distinct variants we have fingerprints for, how many distribution channels we have seen distributing it, and the highest attribution confidence observed (high = curated CTI confirmed, medium = community catalog hint, low = provisional best-guess, unknown = CyStack-discovered with no candidate, benign = false-positive labeling).
Families
Contributing
Found a new variant or correction? Open a pull request adding the fingerprint banner, field keys, and any reference URLs. Sample logs must be sanitized of victim data before submission.