CSCountOfCpuStealer is a CyStack-coined identifier for a
Python-shaped UserInformation.txt panel observed inside
<MONTH DAY> - <count> LOGS.part<N>.rar aggregator packs
at <30-char alphanum>-XT/UserInformation.txt victim
folders. The body is a flat Key: Value block split into
an identity header (Timezone:, Time:, Username:,
PC Name:, OS:, HWID:), a hardware-identifier block
(BIOS Serial Number:, Machine GUID:, BaseBoard Manufacturer:), a Network: section with ipapi.co-style
geolocation (IP:, Country:, Region:, City:,
Postal:), a Hardwares: section (CPU:, Count of CPU cores:, Count of CPU threads:, GPU:, Screen Resolution:), and a bare RAM triple (RAM:, RAM Available:, RAM Used:).
Multiple details in the format read as hand-rolled Python
rather than a compiled C# or NodeJS panel. Time: is
written in time.asctime() shape (Sun Dec 17 11:24:02 2023). Timezone: uses the Olson (IANA) form
(Africa/Accra) that zoneinfo / time.tzname return.
Postal: None writes the Python None literal verbatim
when the ipapi.co lookup returns no postal code. The
verbose Count of CPU cores: and Count of CPU threads:
keys read like an f-string that composed the label from a
psutil.cpu_count(logical=False) / psutil.cpu_count()
call. RAM: values use X.XX GB decimal-GB units, not
the MB or bytes shapes canonical C# panels emit.
Family attribution is provisional pending a published
threat-intel mapping for this exact caption format.
Curated CTI vendors (TrendMicro, SentinelOne Labs,
Kaspersky SecureList, Cyfirma, SOCRadar, Cloudflare
Cloudforce One, Talos, Unit 42, Microsoft TI, Mandiant,
Recorded Future, eSentire, ANY.RUN) and community
catalogues (MalBeacon what-is-this-stealer, deepdarkCTI,
Malpedia, lexfo/stealer-parser, thredb/sysinfo-parser)
do not document this exact Count of CPU cores: +
Postal: None combination. The closest Python-hand-rolled candidates surveyed (Blank Grabber, XillenStealer,
Inf0s3c) either use a different filename
(Information.txt), a different banner (<name> got a new victim:), or different field vocabulary (Computer Name: + Total Memory: + UUID: rather than PC Name:
RAM: + HWID: + Machine GUID:).
