CSMrdUidStealer is a CyStack-coined identifier for an
info-stealer _Information.txt panel observed inside !! 2025 DEC.part01.rar aggregator packs at
<id>_<CC>_<IPv4>_<DD-MM-YY>/_Information.txt victim folders.
The body is a 12-line flat Key: Value block followed by
three labelled sections (Installed software:, Disk:,
Process:).
Two on-disk quirks pin the format. The UID: field carries a
mrd-<16-hex> prefix that no documented stealer uses (Vidar /
Lumma / Redline / Raccoon / Mars / Oski / StealC all emit bare
hex / GUID / volume-serial-derived HWIDs without a literal
prefix). The DateTime: line splits two timestamps onto one
row with a || pipe-pipe separator: DateTime: <DD.MM.YYYY> || Registration: <DD.MM.YYYY HH:MM:SS>. DateTime is the
panel-side log-emission date, Registration is an earlier
date (often years prior) the panel records as the victim's
first-seen timestamp.
Three sub-quirks reinforce the fingerprint. CPU: <name> <spaces> core <N> appends a panel-side core / thread count
after the WMI processor name. RAM: physical <N>MB , virtual <N>MB reports both physical and virtual totals on one line
with comma-space separation. Display Resolution: <W> x <H>
uses spaces around the x separator (rather than the tight
WxH form most stealers emit).
Family attribution is provisional. Public reporting and the
public stealer-format catalogues do not document a family that
emits this exact field combination. Mars Stealer collects an
overlapping subset (Keyboard Languages, Display Resolution, Installed RAM) per public analyses, but ships a
different on-disk layout with bracket-delimited sections
rather than this bare-key flat shape.
