CSNewLogStealer is a CyStack-coined identifier for an
eight-line Information.txt panel notification stub observed
inside !! 2025 OCT.part01.rar-style aggregator packs in
<id>_<CC>_<IPv4>_<DD-MM-YY>/ victim folders (e.g.
1175_CE_<IPv4>_21-10-25/). The body opens with the
literal banner ⚡️NEW LOG (NOT ENCRYPTED) (the trailing flag
implies the panel also has an encrypted payload variant),
follows with a comma-separated data line Username: <user>, Location: <country> [<CC>], <city>, then enumerates six
emoji-prefixed table-of-contents section names: 🖥General information, 🌐Browser Data, 🌐Browser History,
🎆Screenshots, ⚙️Process List, 📦Desktop Files. The TOC
entries are pointers to sibling sub-folders that ship the
actual harvest inside the per-victim archive; this file is the
panel's notification stub rather than the data itself.
The (NOT ENCRYPTED) annotation is the panel's developer side
quirk and serves as the disambiguating signal: no other cataloged format uses this literal. Family attribution is
provisional pending a published threat-intel mapping for this
banner-plus-TOC layout. The closest documented candidates
checked - Continental Stealer, AuraStealer, Mystic Stealer,
Lumma, and the PXA Stealer panel caption - publish different
banner conventions.
