The auctioneers indicate that they have the "server side" code. Kaspersky would only have the "client side" code.

...The client gets infected with malware and sends the data home... to some server. The server side.

But the servers are uninteresting, the clever part is just the client code. And that in original source form, not as the binary. But also much more until the 0-days used are patched.

It would be reasonable to assume that the data in the auction contains as-of-yet undiscovered exploits. this also makes sense when you consider we will not likely know who walks away with this.