Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSSystemSummaryStealer Infostealer Analysis: Targets & TTPs

CSSystemSummaryStealer

Also known as:

What is the CSSystemSummaryStealer infostealer, and what data does it steal?

CSSystemSummaryStealer is a CyStack research label for information-stealer traces. CSSystemSummaryStealer targets browser credentials, System fingerprint: hostname, IP, OS, CPU cores / threads, RAM, GPU list, display resolution per monitor, Locale: country, language, keyboard locale, UTC offset, Laptop boolean flag (TRUE / FALSE), Running process inventory (full process list with count) and Installed application inventory split by HKLM (`All Users:`) and HKCU (`Current User:`) registry hives. As of 11/10/2026, CyStack's research records 1 variant, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSSystemSummaryStealer is a CyStack-coined identifier for a System.txt panel opening with two flush-left identity lines (- IP: and - Country:), then a System Summary: section header followed by a 14-field tab-indented dashed-key block (- OS:, - Architecture:, - UserName:, - Computer Name:, - Local Time:, - UTC: <integer>, - Language:, - Keyboards:, - Laptop: TRUE/FALSE, - Cores:, - Threads:, - RAM:, - Display Resolution: with nested per-monitor block, - GPU: list). Three trailing section headers Process count: + Process List: + Installed Apps: add a process inventory and an installed-app inventory split into All Users: and Current User: subsections.

Observed inside MAY 02 - 8230 LOGS2 aggregator packs at [<ISO2>]<IPv4>/System.txt victim folders, the same country-IPv4 victim-folder convention used by CSCookiesSoftStealer. The field set overlaps an October 2023 Continental Stealer writeup but the exact panel layout is not documented in public reporting. Family attribution is provisional pending a public writeup that confirms the panel format.

MITRE ATT&CK technique mapping

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`49811b3...`	1	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Sample log format

1💎Buy: <value>2 3❗️Actual Link: <value>4 5	- IP: <value>6	- Country: <value>7 8System Summary:9	- HWID: <value>10	- OS: <value>11	- Architecture: <value>12	- UserName: <value>13	- Computer Name: <value>14	- Local Time: <value>15	- UTC: <value>16	- Language: <value>17	- Keyboards: <value>18	- Laptop: <value>19	- Running Path: <value>20	- CPU: <value>21	- Cores: <value>22	- Threads: <value>23	- RAM: <value>24	- Display Resolution:25			Device Name: <value>26			Device String: <value>27			Resolution: <value>28			Color Depth: <value>29	- GPU:30 31Process count: <value>32Process List:33Current User: