CSTop20ProcStealer is a CyStack-coined identifier for a
seven-section info.txt panel observed inside @BRADMAX 60000 MARCH-APRIL.part01.rar Telegram aggregator packs at @BRADMAX <count> <MONTHS>/ [<CC>]UNKNOWN_(<N>)/info.txt filler-folder
paths. The body ships seven triple-equals-wrapped section
headers in fixed order: === SYSTEM INFORMATION ===, === WINDOWS VERSION ===, === HARDWARE INFORMATION ===, === NETWORK INFORMATION ===, === RUNNING PROCESSES (Top 20) ===, === INSTALLED BROWSERS ===, === TIME INFORMATION ===.
The parenthesised (Top 20) qualifier on the RUNNING
PROCESSES section header is the most distinctive marker: no
other cataloged format or documented family emits this exact
literal. The panel then lists at most 20 processes in <Name> (PID: <int>, Memory: <int> MB) format ranked by working-set
memory descending.
The field vocabulary maps to .NET Environment class
properties: 64-bit OS: True / 64-bit Process: False
(Environment.Is64BitOperatingSystem /
Environment.Is64BitProcess), Processor Count
(Environment.ProcessorCount), System Directory
(Environment.SystemDirectory), User Domain
(Environment.UserDomainName). The Uptime value uses the
.NET TimeSpan.ToString() default format (00:07:37.4530000,
seven-digit fractional seconds). The Current Time value uses
the .NET DateTime. ToString() en-US default (M/D/YYYY h:mm:ss tt). All of these point at a private .NET stealer
that authored its own panel template rather than forking an
open-source project.
Family attribution is provisional pending a published
threat-intel mapping for this layout. Public reporting and
community catalogues do not attest a family emitting this
seven-section triple-equals layout. Candidates ruled out
include Bandit Stealer (Go-based, different output shape),
PupkinStealer (.NET but no free-form info.txt), Aurora Stealer
(JSON wire format), Ailurophile, MeltStealer, ZestyChips.
