en
Olson TZ geo-only info.txtTight-colon 5-field geo panelCSOlsonTzGeoStealer (also known as Olson TZ geo-only info.txt and Tight-colon 5-field geo panel) is a CyStack research label for information-stealer traces. CSOlsonTzGeoStealer targets Geo-IP enrichment only: victim IP, city, region name, ZIP / postal code, IANA timezone name. As of 11/10/2026, CyStack's research assesses unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSOlsonTzGeoStealer is a CyStack-coined identifier for a
minimal 5-field geo-only info.txt panel observed inside
the 25-26 JUNE - 5000 LOGS2.rar aggregator pack. The
panel emits only City, Region, IP, TimeZone,
and ZIP fields with a distinctive tight-colon convention
(no space between the colon and the value) and an IANA / Olson
timezone format (TimeZone:Europe/Paris instead of the
UTC±HH:MM offset shape most canonical stealers emit).
The 5-field set matches an ipinfo.io or ip-api.com
geo-lookup response verbatim, so the underlying builder is
likely a Python-based stealer that ships the raw geo-API
response as its info.txt.
No banner, no HWID line, no host fingerprint (OS, CPU, RAM,
user, hostname all absent). The HWID appears in the folder-path prefix <CC>[<HWID>][<TIMESTAMP>]/ but the body
itself is heavily truncated. Family attribution is
provisional pending a published threat-intel mapping.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
