en
CSMinutesFromGmtStealer is a CyStack research label for information-stealer traces. CSMinutesFromGmtStealer targets Installed-software inventory (bare `Installed applications:` block), System hardware and locale (`System Information:` block) and Geolocation (country code + IPv4 in `IP info:` composite). As of 11/10/2026, CyStack's research assesses unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSMinutesFromGmtStealer is a CyStack-coined identifier for
a System Info.txt panel whose timezone field is emitted
as +NNN minutes from GMT (a signed integer minute
offset with a trailing GMT literal). The format mirrors
the JavaScript Date.prototype.getTimezoneOffset semantics,
hinting at a Node.js or Electron-based panel. Cyfirma's
LTX Stealer writeup and Microsoft's Node.js-abuse guidance
both document Node.js-runtime stealers as a growing
category, but no curated CTI vendor documents this exact
panel layout.
Observed inside MARCH 15 - 3059 LOGS.part01.rar
aggregator packs at
[<CC>]<32-hex-lowercase-HWID>/System Info.txt victim
folders. The filename carries a literal ASCII space; the
folder shape uses lowercase 32-hex HWID with a bracketed
country-code prefix. Body opens with a bare IP info: <CC> <IPv4> two-word first-line key that packs the country
code and IPv4 on one line, followed by a bare
System Information: section header, tab-indented
- Key: Value sub-fields (Locale, Time zone, OS,
Architecture, CPU, RAM, Display size, Display Devices
nested numbered list), and a bare Installed applications:
section with tab-indented <Name> <Version> per-app
entries. Family attribution is provisional pending a
published threat-intel mapping for this layout.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
