CSBradMaxPwshStealer

Also known as:@BRADMAX PowerShell-harness system.txt sliceBRADMAX Build+MachineGuid+Level-column variant

What is the CSBradMaxPwshStealer infostealer, and what data does it steal?

CSBradMaxPwshStealer (also known as @BRADMAX PowerShell-harness system.txt slice and BRADMAX Build+MachineGuid+Level-column variant) is a CyStack research label for information-stealer traces. CSBradMaxPwshStealer targets Host hardware and OS fingerprint (CPU, GPU, RAM, monitor count, screen resolution, OS version), Network identity (IP address, country, system language, timezone), Account identity (Windows username, computer name, MachineGuid, Active Directory join state), Installed software inventory (line-per-package), Running-process tree snapshot with parent process IDs and full command lines and Resident antivirus product list with Win32_Reg_AV productState DWORD. As of 11/10/2026, CyStack's research records 1 distribution channel, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSBradMaxPwshStealer is a CyStack-coined identifier for a banner-less system.txt panel distributed through the @BRADMAX Telegram channel. The body opens with a flat Build: <8-char> / IP: / Country: / MachineGuid: / Computer: / User: key block, then ships raw PowerShell cmdlet output: a Get-WmiObject Win32_Processor | Format-Table Name,NumberOfCores,NumberOfEnabledCore, NumberOfLogicalProcessors CPU table (with the literal dashed underline row), an AV List: block emitting raw <Name>. Product State: <DWORD> Win32_Reg_AV records, host fields (OS:, Monitors:, Resolution(s):, AD:, GPU:, RAM:, System Language:, Timezone:), a Processes: section with Get-Process | Format-List ProcessId,ParentProcessId,Name,CommandLine,Level records, and a Software: line-per-package installed-software list.

The custom Level Get-Process column is not a native System.Diagnostics.Process property, which points to a PowerShell or .NET launcher harness that enriches each process record with an integrity-level or tree-depth value before formatting. Family attribution is provisional pending a published threat-intel mapping for this harness layout; no public reporting or community catalogue documents this exact PowerShell-cmdlet-output shape.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Panel name	Distribution channel	Confidence
—	Telegram	Unknown

Data is masked to protect the community

The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence