CSFilesStolenStealer is a CyStack-coined identifier for a
compact ten-line system.txt panel whose distinctive
signature is the stealer-self-reporting Files Stolen:
counter field. Observed inside JANUARY 15,16 - 4728 LOGS.part1.rar Telegram aggregator packs at
<HH-MM-SS>/system.txt victim folders (e.g.
00-39-28/system.txt). The archive-name convention with
comma-separated dates matches the operator lineage of
CSStartBuildInfoStealer (4,5 MAY) and
CSExePathInfoStealer (5,6 APRIL) from the same reseller
pipeline.
The body ships ten flush-left Key: Value lines: PC Name,
Desktop Name, Windows Version, Files Stolen, IP Address, MAC
Address, GPU, RAM, Public IP, Antivirus. No bracketed section
headers, no banner, no trailing sections. Four features
distinguish this panel from every other cataloged format:
PC Name: plus Desktop Name: sibling pair with both
fields taking the same value on typical single-user Windows
hosts. Common stealer panels emit Computer Name /
ComputerName / Hostname as a single key, never as a PC Name + Desktop Name pair. 2. Files Stolen: inline counter
for the number of files the harvester exfiltrated. Canonical
Vidar, StealC, and Lumma emit grab counts in a separate
summary section or not at all - in-body counter fields are
rare across surveyed families. 3. Dual IP fields side by side:
IP Address: carries the RFC-1918 LAN value (192.168.x.x,
10.x.x.x, 172.16-31.x.x) and Public IP: carries the WAN
routable value. The routable value is the primary network IOC; the LAN
value remains useful for host-level triage. 4. MAC Address: value uses hyphen byte separators (Windows ipconfig
style) rather than the more common colon-separated form.
RAM: value uses comma thousands separator (18,308 MB).
The Windows Version: value carries a trailing - sentinel
with no product-name text after it (as if the panel builder
intended to append a Windows edition string but the resolver
returned an empty value on the observed sample). The bare NT version before that sentinel is the reliable OS
value.
Family attribution is provisional. The ten-field combination
is unattested in public reporting and is also absent from the
community stealer-format catalogues. Multiple open-source
Python stealer builders (XillenStealer, Trap Stealer,
SPYSTEALER, py-stealer-builder) publish plain-text system
reports but none of the surveyed writeups document this exact
ten-field key spelling. Update this tracking profile if a public writeup later maps
this layout to a known builder.
