CSMinimalGeoStealer is a CyStack-coined identifier for a flat
5-line panel-summary Information.txt observed inside 22-23 SEPTEMBER - 20373 LOGS2.part1.rar Telegram aggregator packs.
The victim folder name is a random uppercase-alphanumeric ID
plus a Python-style timestamp
(<32-CHAR-ID>_YYYY_MM_DDTHH_MM_SS_micros/), pointing at a
Python or Go builder that mints the folder from
datetime.utcnow().isoformat() with punctuation swapped for
underscores.
The body has exactly five bare Key: Value lines:
Username:, IP Address:, Country Code:, OS Version:,
Antivirus:. No banner, no HWID, no hostname, no hardware
inventory, no build tag, no timestamp inside the body.
Distinguishing key spellings: IP Address: (two-word form,
space between IP and Address), Country Code: (two-word form
with capital-C Code, bare ISO 3166-1 alpha-2 value),
Antivirus: (lowercase v), and OS Version: carrying the
WMI Win32_OperatingSystem.Caption prefix (e.g. Microsoft Windows 11 Pro).
Family attribution is provisional pending a published
threat-intel mapping for this minimal layout. Public reporting
and the community catalogues do not attest a family emitting
exactly this 5-field shape with the specific key spellings
above. Candidates ruled out include Raven Stealer,
SamsStealer, PupkinStealer, XillenStealer, Braodo, and
BoryptGrab (all documented body shapes are richer or differ in
field-key spelling). Update this tracking profile if a public
writeup later identifies the underlying builder.
