CSAntiSandboxStealer is a CyStack-coined identifier for a
triple-equals-section system_info.txt panel observed inside
!! 2025 DEC.part01.rar aggregator packs at
[<CC>]<IPv4>/system_info.txt victim folders. The body opens
with six Title-case === <Section> === headers (=== System Information ===, === Network ===, === Hardware ===, === Disk ===, === Anti-Sandbox Diagnostics ===, === Summary ===) and a verbatim Anti-Sandbox Diagnostics block that
exposes the stealer's sandbox-detection logic line by line
with arrow-verdict suffixes (-> PASS / -> FAIL).
The diagnostic block is the panel's distinguishing
developer-side quirk. Most stealers hide their sandbox-detection logic so analysts cannot easily map the thresholds,
but this builder prints every check and its configured
threshold (RAM: 3 GB (threshold: 8 GB) -> FAIL). The === Summary === block carries the Anti-Sandbox: ENABLED flag
plus a Mode: V2 (Evasive) panel-version identifier; the V2
literal suggests this is the second revision of the builder's
anti-sandbox logic.
Public reporting and the community stealer-format catalogues
do not document a family that emits this exact
triple-equals-section + verbatim diagnostic block +
arrow-verdict shape. Multiple public writeups document modern
stealers that implement anti-sandbox checks (Lumma C2, Typhon
Reborn V2, Akira Stealer v2, Rhadamanthys, Vidar 2.0), but
none of those writeups quote a sample log with the diagnostic
block exposed verbatim. The format may be a debug /
developer-test build of one of those families that left the
verbose diagnostic output enabled, or a separate undocumented
builder. Family attribution is provisional pending a published
mapping.
