CSRedhiveStealer is a CyStack-coined identifier for a
Lumma-shape System.txt panel that self-brands as
Redhive Stealer on its build banner line. Observed inside
BONUS$#01(c)_NEW_ROYCLOUD_HQ_MIX_<n>_<Mon>_<YYYY>.part1.rar
archives at <CC>_<IPv4>-<HWID>/System.txt victim folders
(e.g. CO_181.52.194.15-043BD157EE/System.txt), preceded by
the same stylised RÔýĆløud reseller banner that wraps the
Remus and bare key-value variants distributed through the same
channel.
The body opens with - Redhive Stealer: <DD.MM.YYYY> and
- Lid: <numeric>, then continues with the Lumma-canonical
dash-prefixed field set: - OS Version, - System Installed
(ISO calendar date, replaces canonical Lumma - Install Date), - Local Date, - Time Zone, - Computer, - User,
- Language, - Anti Virus, - HWID, - RAM Size, - CPU Name, - CPU Threads, - CPU Cores, - GPU, - Display resolution, - IP Address, - Time Save Log (ISO datetime,
replaces canonical Lumma - Time), - Country. The - CPU Vendor field canonical Lumma always emits is absent, and the
Lumma-canonical (sig:UNIX.HEX) watermark is stripped
entirely from the timestamp line. HWID is short-form 8-hex
rather than the canonical Lumma 32-hex hash.
The - Lid, - Computer, - User, - Anti Virus, - HWID,
- RAM Size, - GPU, - IP Address, - Country
dash-prefixed vocabulary is documented as Lumma-canonical by
MalBeacon what-is-this-stealer, Outpost24 LummaC2 analysis,
and Cloudflare Cloudforce One playbook analysis of Lumma
panel output. The Redhive Stealer self-brand string is
novel and unattested in curated CTI mappings at time of
integration; the profile is classified as a Lumma variant
because the field lattice unambiguously matches documented
Lumma output.
