CSTxtFilesPartStealer is a CyStack-coined identifier for
an Arabic-language Telegram-bot manifest panel that ships
as a three-line Information.txt victim file. Observed
inside !! 2025 JULY.part001.rar at
[<CC>]<ip>/Information.txt victim files.
The body carries three emoji-prefixed lines: a
📁 TXT Files | Part <N> partition header, a 🌍 IP: <ipv4> victim public IP line, and a 📦 عدد الملفات: <count> Arabic file-count line. The Arabic literal
عدد الملفات reads as Number of files and is the
panel's developer-side label, indicating the operator is
Arabic-speaking. The Part <N> suffix on the header is a
per-victim upload-batch identifier the panel emits when
it splits a larger pack across multiple partitions.
Family attribution is provisional pending a published
threat-intel mapping for this layout. The general
Telegram-bot exfiltration shape is broadly documented
(Bitsight, KELA), but no curated CTI source ties the
Arabic file-count literal and the TXT Files | Part <N>
partition convention to a specific named family.
Also known as: Arabic TXT Files Part Telegram manifest, عدد الملفات file-count emoji panel
Variants observed: 1
Top attribution confidence: unknown
- Victim public IP (in the
🌍 IP:line) - Per-victim harvested-file count (in the Arabic line)
- Per-victim partition index (
Part <N>in the header)
Attribution confidence: unknown
Filenames: Information.txt
Sample (sanitized):
📁 TXT Files | Part 4
🌍 IP: <ip>
📦 عدد الملفات: 64
Fingerprint requires the line-anchored
📁 TXT Files | Part partition header AND 🌍 IP: line
AND 📦 عدد الملفات: Arabic file-count literal. The
three-anchor combination cannot collide with sibling
emoji-prefixed panels: CSEmojiInfoStealer uses a
different emoji set (🖥️ User:, 🌐 IP:,
📋 OS Name:) plus the 📝 Grabbed files: section
header. During triage, treat the family attribution as
unknown: the underlying builder is undocumented in
surveyed curated CTI sources and community catalogues.
The Part <N> index can be used to correlate per-victim
partitions with the operator's Telegram-channel upload
history.