Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

4-section ✅/❌ checkmark stealer Malware Analysis

CSEmojiCountStealer

Also known as:Dash-section emoji-count Information.txt panel4-section ✅/❌ checkmark stealer

What is the CSEmojiCountStealer infostealer, and what data does it steal?

CSEmojiCountStealer (also known as Dash-section emoji-count Information.txt panel and 4-section ✅/❌ checkmark stealer) is a CyStack research label for information-stealer traces. CSEmojiCountStealer targets browser credentials, cryptocurrency wallets, Discord session tokens, Grabbed files, Credit cards, FTP and SSH server credentials and Per-victim IP / country / city / ISP geolocation. As of 11/10/2026, CyStack's research records 1 variant, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSEmojiCountStealer is a CyStack-coined identifier for an Information.txt panel divided into four - IP Info - / - PC Info - / - Other Info - / - Log Info - sections with dash-space-name-space-dash captions. The Log Info section ships a Build:_____ placeholder and a per-category count line for each artifact type using ✅ (data harvested) or ❌ (category empty) emoji indicators. Eight count categories are tracked: Passwords:, Cookies:, Wallets:, Files:, Credit Cards:, Servers FTP/SSH:, Discord Tokens:, Others:. Observed inside !! 2025 NOV.part001.rar aggregator packs in [<CC>]<IP>/Information.txt victim folders.

The body carries FileLocation: and Current Language: field names that match Redline canonical, but the surrounding section structure (dash-space captions, emoji count indicators, Build:_____ placeholder) does not match Redline canonical (no Operation System: typo, no Hardwares: block, no Anti-Viruses: block). Family attribution is provisional pending a published threat-intel mapping for this layout.

MITRE ATT&CK technique mapping

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`74aa5cc...`	119	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Sample log format

1IP: <value>2Country: <value>3City: <value>4Postal:5ISP: <value>6Timezone: <value>7 8OS: <value>9CPU: <value>10GPU:11HWID: <value>12Current Language: <value>13FileLocation: <value>14Is Elevated: <value>15 16Antivirus:17 18Build:<value>19 20Passwords: <value>21Cookies: <value>22Wallets: <value>23Files: <value>24Credit Cards: <value>25Servers FTP/SSH: <value>26Discord Tokens: <value>27Others: <value>