CSBradmaxRedlineTruncStealer is a CyStack-coined identifier
for the BRADMAX-truncated Redline-shape System.txt panel
where the identity preamble (IP:, UserName:,
MachineName:, Country:) is stripped by the aggregator and
the body starts flush with Zip Code:. Observed inside
@BRADMAX 27000 FEB-MARCH.part01.rar at @BRADMAX <count> <MONTHS>/[<CC>]<IPv4>/System.txt victim folders (e.g.
@BRADMAX 27000 FEB-MARCH/[DE]<IPv4>/System.txt).
Body vocabulary is Redline-canonical: the Operation System:
typo (singular Operation, no trailing ing), the Available KeyboardLayouts: plural marker (no space between Keyboard
and Layouts), the Hardwares: block header with Name: <label>, <values> rows below (RAM row uses the
dual-serialisation <N.NN> Mb or <bytes> bytes format, GPU
rows use <vendor> <model>, <bytes> bytes), plus a bare
Windows Defender line at the tail with no AV: /
Antivirus: key prefix. The FileLocation: field emitted by canonical Redline UserInformation.txt panels is absent, distinguishing this preamble-stripped variant from the canonical layout.
The same underlying panel-render lineage appears in the Daisy
Cloud reseller output handled by CSDaisyBlockCloudStealer
(which retains the identity preamble and adds a pipe-bordered
ASCII-art banner) and CSDaisyCloudStealer (per-line
watermark overlay). This BRADMAX-truncated variant is the
bannerless, preamble-stripped sibling.
Family attribution is provisional pending a published
threat-intel mapping for this specific stripped variant.
Public reporting and community catalogues document the
underlying Redline body shape but do not attest this specific
BRADMAX-stripped preamble-less variant. Without the canonical
FileLocation: anchor and identity preamble it is impossible
to confirm the builder is stock Redline versus a Redline-fork
(Meta, Aurora, Amadey inherit some Redline vocabulary).
