CSBase64CpuStealer is a CyStack-coined identifier for a flat
UserInformation.txt panel observed inside @BRADMAX 21300 APRIL.part1.rar Telegram aggregator packs at @BRADMAX <count> <MONTH>/[<CC>]<IPv4>/UserInformation.txt victim
folders. The body has a compact 13-field flat Key: Value
layout with three distinctive quirks: an L_HWID: field that
duplicates the HWID: value in lowercase (the L_ prefix
appears to stand for lowercase), a CPU Name Base64: field
that base64-serialises the plain CPU Name: value above
(verified: the sample string
SW50ZWwoUikgQ29yZShUTSkgaTctODcwMEsgQ1BVIEAgMy43MEdIeg==
decodes to Intel(R) Core(TM) i7-8700K CPU @ 3.70GHz), and a
paired Log Date: plus Grab Start Date: header that records
both the harvest start and the panel-render time in the same
DD MMM YYYY HH:MM UTC[+-]H shape.
The panel splits the IP geolocation lookup into two adjacent
fields: IP Location: <country name>, <city name>
(human-readable form) plus IP Country Code: <ISO2> (the
machine-readable alpha-2 code). The OS field uses the
Redline-canonical typo Operation System: (sic, Operation
rather than Operating), and the AV field uses the
Vidar-style plural AVs: key. The mix of Redline and Vidar
spelling conventions plus the Russian-adjacent UTC+3 timezone
in the sample points at a Russian-speaking developer who
studied Redline's output format but adopted some Vidar
field-name conventions. The redundant base64 duplicate of the
CPU name may be a panel-side workaround for character-set
corruption on ASCII-hostile channels.
Family attribution is provisional pending a published
threat-intel mapping for this layout. Public reporting and the
community catalogues do not attest a family emitting exactly
this 13-field layout with the L_HWID / CPU Name Base64
duplicates. Candidates ruled out: Aurora (different field
spellings, JSON wire format), Redline / Redline-like
(different identity preamble), Vidar (uses AV singular and has
a bracketed section header), StealC v2 (base64 lives in the
wire protocol, not the log file), Torg Grabber, CGrabber,
Marco Stealer, Raven Stealer.
