CSInternalIpStealer is a CyStack-coined identifier for a
flattened Information.txt panel with square-bracket section
headers ([Basic] / [Network] / [Drives] / [GPU]) and a
distinctive Internal IP: LAN-IP field paired with the
public-IP Ip: field. Observed inside @BRADMAX 12000 FEB-MARCH.part1.rar at @BRADMAX <count> <MONTHS>/[<CC>]<IPv4>/Information.txt victim folders (e.g.
[UN]<IPv4>).
The body ships three physical lines that concatenate the
entire identity preamble plus four bracket-marked section
blocks. Fields include Ip: (lowercase p), Internal IP:
(LAN address), HWID: (64-hex SHA256), Clipboard:
(opportunistic content), Build: (Windows build number), OS Arch: (x64/x86), CPU Name:, Logical Cores:, RAM Total (MB):, RAM Available (MB):, and Domain:. Section headers
appear inline mid-line rather than on their own rows because
of the aggressive-collapse repacking.
The HWID SHA256 length points at newer stealer builds
(Arkanix Stealer is publicly documented as using SHA256 for
HWID). The dual public + LAN IP pair is unusual: most
canonical stealers emit only the public IP. The RAM Total (MB): / RAM Available (MB): parenthesised-unit value shape
is also unusual.
Family attribution is provisional pending a published
threat-intel mapping. Public reporting and community
catalogues do not attest a family emitting this exact flat
bracket-section layout. Candidates ruled out include Arkanix
Stealer (JSON wire format serialised to
%LOCALAPPDATA%\Arkanix_lol\<class>.json), Valkyrie Stealer
(JSON output), Easy Stealer (Dashboard-panel view without
published log-file format), Redline (uses Hardwares: block
with Name: sub-entries), BracketSectionStealer (uses
[System] + [Hardware] sections), AMOS (macOS-specific
system_profiler output).
