CSSystemRegionStealer is a CyStack-coined identifier for a
flat 12-field info.txt panel observed inside 10-13 SEPTEMBER - 20370 LOGS.part01.rar Telegram aggregator packs
at <33-CHAR-HEX-ID>/info.txt victim folders. The
33-character uppercase-hex folder ID is one character longer
than a standard 32-char MD5, hinting at a MachineGuid-derived
or custom-hashed victim identifier.
The body layout is a flat Key: Value block with these fields
in fixed order: OS Version: (WMI Caption plus parenthesised
(Build N) suffix), Local Date: (Russian or European
DD.MM.YYYY HH:MM:SS format, no timezone), PC name:
(lowercase-n key), User name: (lowercase- n), Screen Resolution:, Processor:, Total RAM:, Graphics Card:,
MAC Address(es): (parenthesised (es) plural marker with a
comma-separated MAC list), IP Address:, Country: (full
country name from an IP geolocation API), and System Region:
(system locale from GetUserDefaultLocaleName or the WMI
MUILanguages field, distinct from the IP-based Country:
field above).
The body terminates with a long -=-=-=-=- alternating
dash-plus-equals separator followed by the Russian text Здесь могла бы быть ваша реклама ("Your ad could be here"). The
trailer is a well-known Russian internet meme for empty ad
placeholders; embedding it in the panel output is either a
stealer-author signature or an unfinished template feature the
operator never populated. The trailer strongly suggests a
Russian-speaking developer even though every field key is in
English.
Family attribution is provisional pending a published
threat-intel mapping for this layout. Public reporting and the
community catalogues do not attest a family emitting exactly
this 12-field layout with the MAC Address(es): plural
marker, the split Country: / System Region: geolocation
pair, and the Russian ad-meme trailer. Candidates ruled out
include Sharp / Hannibal / TX (different field spelling, no
split geolocation), Poulight (pure Russian key set), CGrabber,
Torg Grabber, Predator The Thief, Collector-Stealer, Marco
Stealer, and Raven Stealer.
