CSBradMaxUserInfoStealer is a CyStack-coined identifier
for a box-drawn USER INFO panel distributed through the
@BRADMAX Telegram log-reseller channel (distinct from the
sibling @BRADMAX_CLOUD reseller). Observed inside
@BRADMAX <N> <MONTH>-<MONTH>.part<N>.rar aggregator
packs at [<CC>]UNKNOWN_(<N>)/info.txt victim folders.
The body opens with a double-line Unicode box wrapping a
centered USER INFO banner title, and is terminated by a
matching double-line box wrapping END OF USER INFO.
Between the two outer boxes, five single-line Unicode
boxes enclose section titles in fixed order: BASIC INFORMATION, HARDWARE, NETWORK & LOCATION,
SOFTWARE, TIME. The merged BASIC INFORMATION
section corresponds to the dedicated [ IDENTIFICATION ]
plus [ OS ] pair the sibling SYSTEM INFORMATION REPORT layout emits.
Each section carries column-18 aligned-colon Key : Value fields with trailing-space padding on the key
side. Field vocabulary matches the sibling SYSTEM INFORMATION REPORT layout except this presentation
drops the dashed-UUID HWID field: Windows NT-style
OS Version, .NET CLR Version and TimeSpan Uptime,
Country with trailing parenthesised ISO-2 country
code, Public IP + Local IP + MAC Address network
trio, Installed Updates + Antivirus + Firewall
software trio, and Current (UTC) + Current (Local)
Timezone time trio where the timezone value carries
both a Windows display name and a UTC offset with
seconds (the positive-sign prefix is sometimes dropped).
The same .NET panel-builder family (CLR Version +
TimeSpan Uptime combination) that produces the sibling
SYSTEM INFORMATION REPORT layout appears here under a
different theme toggle. No curated CTI vendor documents
either presentation.
Family attribution stays CyStack-coined (Case C) pending
a published mapping. HEROIC darkhive-breaches attests the
@BRADMAX distributor at multiple pack entries separately
from the @BRADMAX_CLOUD sibling. Candidates ruled out
include Redline canonical (Build ID / IP Address /
Country labelled-block layout differs), Lumma
(Software: and Hardware: sections with dash-bulleted
fields, absent), Vidar (tight [Hardware] section
header, absent), Rhadamanthys (Wallpaper Hash:
required, absent), XFiles (CPU (Processor): parens-alias key,
absent).
