CSCountCoreStealer is a CyStack-coined identifier for a
fifteen-line Information.txt panel summary that opens
with a 🔐 Passwords Count: <n> banner and a
⚙ System Information: header, then ships a keyed field
block carrying NodeJS os module values. Observed inside
!! 2025 OCT.part01.rar-style aggregator packs in
<id>_<CC>_<IPv4>_<DD-MM-YY>/ victim folders (e.g.
1273_UN_86.80.140.21_16-10-25/). The keyed block
carries Mac:, Gpu:, Cpu:, Uuid:, Hostname:,
User Info:, IP Address:, Version:, Type:,
Arch:, Release:, Count Core:, File Location:.
Multi-GPU systems put the second GPU name on its own line
after Gpu: with no key prefix.
The NodeJS os module fingerprint is unmistakable:
Type: Windows_NT is the os.type() literal, Arch: x64
is os.arch(), Release: 10.0.22631 is os.release(),
and Count Core: 8 is the transposed phrasing for
os.cpus().length. The transposed Count Core plus the
User Info: label (rather than Username:) is the
panel's developer-side quirk. Family attribution is
provisional pending a published threat-intel mapping for
this exact caption format. The closest documented
JavaScript / NodeJS infostealer candidates surveyed -
Celestial Stealer (Trellix / CyberInsider), Bizfum
Stealer (Cyfirma), Wish Stealer (Cyfirma) - do not
publish a matching caption format in their write-ups.
Also known as: !! 2025 OCT aggregator NodeJS-os panel summary
Variants observed: 6
Top attribution confidence: unknown
- Browser saved credentials (count flag plus harvested body in sibling files)
- Host metadata: MAC address, hardware UUID, hostname
- Hardware inventory: CPU model, GPU list
- OS fingerprint: NodeJS os.type/arch/release plus friendly Windows version
- Victim public IP
- Stealer install path under
C:\WINDOWS\System32
Attribution confidence: unknown
Field keys:
Arch, Count Core, Hostname, IP Address, User Info, Version
Filenames: System.txt
Sample (sanitized):
⚙ System Information:
Hostname: <redacted>
User Info: Nhật Vy
IP Address: <redacted>
Version: Windows 10 Home Single Language
Arch: x64
Count Core: 8
Attribution confidence: unknown
Field keys:
Arch, Count Core, Cpu, File Location, Gpu, Hostname, IP Address, Mac, Release, Type, User Info, Uuid, Version
Filenames: Information.txt
Sample (sanitized):
🔐 Passwords Count: 7
⚙ System Information:
Mac: <redacted>
Gpu: AMD Radeon(TM) Graphics
Cpu: AMD Ryzen 7 7735H with Radeon Graphics
Uuid: 20230908-14AC-6026-1ECB-14AC60261ECC
Hostname: <redacted>
User Info: Admin
IP Address: <redacted>
Version: Windows 10 Home
Type: Windows_NT
Arch: x64
Release: 10.0.26100
Count Core: 16
File Location: <redacted>
Attribution confidence: unknown
Field keys:
Arch, Count Core, File Location, Hostname, IP Address, User Info, Version
Filenames: System.txt
Sample (sanitized):
⚙ System Information:
Hostname: <redacted>
User Info: Rei
IP Address: <redacted>
Version: Windows 10 Pro
Arch: x64
Count Core: 4
File Location: <redacted>
Attribution confidence: unknown
Field keys:
Arch, Count Core, File Location, Hostname, IP Address, Release, Type, User Info, Version
Filenames: Information.txt
Sample (sanitized):
⚙ System Information:
Hostname: <redacted>
User Info: ADMIN
IP Address: <redacted>
Version: Windows 10 Pro
Type: Windows_NT
Arch: x64
Release: 10.0.19045
Count Core: 4
File Location: <redacted>
Attribution confidence: unknown
Field keys:
Arch, Count Core, File Location, Hostname, IP Address, Release, Type, User Info
Filenames: Information.txt
Sample (sanitized):
⚙ System Information:
Hostname: <redacted>
User Info: Admin
IP Address: <redacted>
Type: Windows_NT
Arch: x64
Release: 10.0.22631
Count Core: 8
File Location: <redacted>
Attribution confidence: unknown
Field keys:
Arch, Count Core, Cpu, File Location, Gpu, Hostname, IP Address, Mac, Release, Type, User Info, Uuid
Filenames: Information.txt
Sample (sanitized):
🔐 Passwords Count: 14
⚙ System Information:
Mac: <redacted>
Gpu: Intel(R) Iris(R) Xe Graphics
Cpu: 13th Gen Intel(R) Core(TM) i5-1340P
Uuid: 4C4C4544-0044-4C10-8030-C3C04F5A3434
Hostname: <redacted>
User Info: Admin
IP Address: <redacted>
Type: Windows_NT
Arch: x64
Release: 10.0.26200
Count Core: 16
File Location: <redacted>
Fingerprint requires the line-anchored Count Core: key
(the transposed phrasing is the disambiguator - no other
registered parser keys on it) plus the
Type: Windows_NT NodeJS os.type() literal. Together
the pair cannot collide with other registered formats.
During triage, treat the family attribution as unknown:
the panel summary is the metadata view of a JavaScript /
NodeJS infostealer whose canonical name has not been
mapped to this caption layout in any surveyed CTI source.