CSBestPrivateLoggerStealer is a CyStack-coined identifier for
a Telegram-bot-exfil stealer that emits a single
bot-<bot-id>-<chat-id>-Userdata.txt victim file with a Best Private LOGGER ASCII-art banner, a ==========PC INFO========== PC-info block, and one
============X============-delimited record per harvested
browser credential. Observed inside !! 2025 JULY.part001.rar
BRADMAX / @BRADLOGS aggregator packs at [<CC>]@BRADLOGS (BRADMAX) (<NN>)/ bot-<bot-id>-<chat-id>-Userdata.txt victim
files.
The PC-info block carries Client Name: (hostname),
FullDate: (US-locale M/D/YYYY - H:MM:SS AM/PM), IP:, and
Country: (full country name like United States rather than
the ISO 3166-1 alpha-2 code). Each credential block carries
URL: / Username: / Password: / Application: fields
with the Application: value carrying browser-name plus
chromium-variant strings (Edge Chromium, observed). The two
numeric segments in the filename encode the operator Telegram
bot's chat ID and the per-victim chat ID, both visible to
whoever harvested the bot inbox.
Family attribution is provisional pending a published
threat-intel mapping for this layout. The Telegram-bot
exfiltration shape is broadly documented as a common pattern
across multiple builders, but no public source ties the Best Private LOGGER banner and the ==========PC INFO==========
panel template to a specific named family.
