CSAdminCoresStealer is a CyStack-coined identifier for a
9-field bare-key System.txt panel observed inside !! 2025 DEC.part01.rar aggregator packs at
<id>_<CC>_<IPv4>_<DD-MM-YY>/System.txt victim folders. The
body is a flat key-value block with uppercase plural-noun
keys (USERNAME, CORES, ADMIN) and no banner, no section
dividers, no trailing footer.
The LID: line carries an affiliate-style <name>-<8-hex>
value (e.g. TINY-47F174B7) that mirrors Lumma Stealer's
pre-March-2025 LID convention documented in public
affiliate-side writeups. The body shape diverges sharply from
canonical Lumma's verbose - Key: Value dash-prefix format,
so family attribution stays CyStack-coined pending a published
confirmation: the LID format could be a coincidence (multiple
stealers may use this name) or a Lumma fork with a radically
reshaped panel template.
The CPU: value can carry virtualization markers (the
observed sample reads AMD EPYC Processor (with IBPB), where
IBPB is the Spectre-v2 mitigation flag QEMU / KVM exposes in
the guest CPU model name). The IP: value falls back to
127.0.0.1 when no external IPv4 is available at exfil time.
Public reporting and the community stealer-format catalogues
do not document a family that emits this 9-field bare-key
uppercase-noun layout.
