Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSCountRunsStealer Infostealer Analysis: Targets & TTPs

CSCountRunsStealer

Also known as:BRADMAX aggregator box-drawing panel summary!! 2025 NOV.part001 EXTRACTION RESULTS panel

What is the CSCountRunsStealer infostealer, and what data does it steal?

CSCountRunsStealer (also known as BRADMAX aggregator box-drawing panel summary and !! 2025 NOV.part001 EXTRACTION RESULTS panel) is a CyStack research label for information-stealer traces. CSCountRunsStealer targets browser credentials, Credit cards with CVC (count flag), Facebook sessions (count flag), Host metadata: hostname, OS version with build and Victim public IP plus city / country / ISP enrichment. As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSCountRunsStealer is a CyStack-coined identifier for an 11-line Information.txt panel summary framed by U+2500 heavy box-drawing characters and split into two captioned sections, SYSTEM INFORMATION and EXTRACTION RESULTS. Observed inside !! 2025 NOV.part001.rar aggregator packs in [<TAG>]<IP>/Information.txt victim folders (e.g. [AK]<IPv4>/Information.txt), distributed through the @BRADLOGS Telegram aggregator that resells multiple underlying stealer families.

The SYSTEM INFORMATION block ships five fields: a combined Location: City, Country (ISP) line (consumer-grade IP geolocation API shape), Device: hostname, OS: in Windows <major>.<minor> (Build <build>) form, IP:, and a Time: value in the JS toLocaleString shape MM/DD/YYYY, HH:MM:SS (UTC[+-]HH:MM). The EXTRACTION RESULTS block ships five count fields: Cookies:, Passwords:, Facebook:, CC with CVC: (the awkward with CVC phrasing for credit-card-with-CVV), and Count Runs: (an execution counter likely incremented across repeated runs on the same victim). Family attribution is provisional pending a published threat-intel mapping for this caption format. The closest documented relative is Phemedrone, which also writes a per-victim Information.txt summary but uses dashed section captions (----- Geolocation Data ----- / ----- Hardware Info -----) and a different field set.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Panel name	Distribution channel	Confidence
—	Telegram	Unknown

Data is masked to protect the community

The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`e5b0760...`	97	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence