CSProcessElevationStealer is a CyStack-coined identifier for a
Redline-shape System.txt observed inside @ft7links-lumma
aggregator packs in @ft7links_lumma_<NN>_bogonip_<HWIDPFX>/
victim folders. The body carries the canonical Redline
Operation System: (sic) typo and Hardwares: block, but
adds a Process Elevation: True|False line that canonical
Redline never emits, joins ScreenSize: and TimeZone: on a
single line with whitespace around the = (canonical Redline
emits no spaces and breaks them onto separate lines), and
strips Redline's identity preamble (Build ID:, IP:,
FileLocation:, MachineName:, Location:, Log date:)
entirely on bogon-IP victims.
A community stealer-format catalogue maps this exact field
shape to ArechClient2 / SectopRAT, and an independent
malware-analysis writeup confirms ArechClient2's collector
emits a matching field set (OSVersion, ScreenSize,
TimeZone, AvailableLanguages, SystemHardwares). The
canonical ArechClient2 / SectopRAT family is well documented
publicly, but none of those writeups publish a sample log
showing the exact label set above, so the format-to-family
mapping remains provisional and the CS prefix is retained
pending a published confirmation.
