CSStatsSectionStealer is a CyStack-coined identifier for a
two-section _INFO.txt panel observed inside !! 2025 DEC.part01.rar aggregator packs at [<CC>]<IPv4>/_INFO.txt
victim folders. The body opens with === SYSTEM INFO === ALL
CAPS triple-equals header (note the shorter INFO form, not
INFORMATION), followed by four flat key-value lines
(Computer:, User:, OS:, Time:), a blank-line
separator, then === STATS === ALL CAPS triple-equals header
followed by three count lines (Cookies:, Passwords:,
Credit Cards:).
The OS: value carries Microsoft Windows NT <major>.<minor>.<build>.<rev> shape, the verbatim .NET
Environment.OSVersion.VersionString output. The Time:
value is the naive yyyy-MM-dd HH:mm:ss form that
DateTime.Now.ToString produces by default in .NET. Together
these point at a .NET-builder runtime.
The dedicated === STATS === section separated from the
system block by a blank line is the panel's distinctive
developer-side quirk. Most other documented stealer panels
inline harvest counts under a Browser Data: or Main Loot:
block (CSGADSPanel, CSMainLootStealer) or omit them entirely.
The shorter === SYSTEM INFO === header rules out
CSEnvVarDumpStealer (which keys on the longer === SYSTEM INFORMATION === form) and CSAntiSandboxStealer (Title-case
header).
Public reporting and the public stealer-format catalogues do
not document a family that emits this exact two-section panel
layout. Family attribution is provisional pending a published
mapping.
