Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSCountCoreStealer Infostealer Analysis: Targets & TTPs

CSCountCoreStealer

Also known as:!! 2025 OCT aggregator NodeJS-os panel summary

What is the CSCountCoreStealer infostealer, and what data does it steal?

CSCountCoreStealer (also known as !! 2025 OCT aggregator NodeJS-os panel summary) is a CyStack research label for information-stealer traces. CSCountCoreStealer targets browser credentials, Host metadata: MAC address, hardware UUID, hostname, Hardware inventory: CPU model, GPU list, OS fingerprint: NodeJS os.type/arch/release plus friendly Windows version, Victim public IP and Stealer install path under `C:\WINDOWS\System32`. As of 11/10/2026, CyStack's research records 1 variant, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSCountCoreStealer is a CyStack-coined identifier for a fifteen-line Information.txt panel summary that opens with a 🔐 Passwords Count: <n> banner and a ⚙ System Information: header, then ships a keyed field block carrying NodeJS os module values. Observed inside !! 2025 OCT.part01.rar-style aggregator packs in <id>_<CC>_<IPv4>_<DD-MM-YY>/ victim folders (e.g. 1273_UN_<IPv4>_16-10-25/). The keyed block carries Mac:, Gpu:, Cpu:, Uuid:, Hostname:, User Info:, IP Address:, Version:, Type:, Arch:, Release:, Count Core:, File Location:. Multi-GPU systems put the second GPU name on its own line after Gpu: with no key prefix.

The NodeJS os module fingerprint is unmistakable: Type: Windows_NT is the os.type() literal, Arch: x64 is os.arch(), Release: 10.0.22631 is os.release(), and Count Core: 8 is the transposed phrasing for os.cpus().length. The transposed Count Core plus the User Info: label (rather than Username:) is the panel's developer-side quirk. Family attribution is provisional pending a published threat-intel mapping for this exact caption format. The closest publicly documented JavaScript / NodeJS infostealer candidates - Celestial Stealer, Bizfum Stealer, Wish Stealer - do not publish a matching caption format in their write-ups.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`1021cf3...`	23,809	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Sample log format

1🔐 Passwords Count: <value>2⚙ System Information:3 4Mac: <value>5Gpu: <value>6Cpu: <value>7Uuid: <value>8Hostname: <value>9User Info: <value>10IP Address: <value>11Version: <value>12Type: <value>13Arch: <value>14Release: <value>15Count Core: <value>16File Location: <value>