CSDashPlusSepStealer is a CyStack-coined identifier for an
11-stanza Information.txt panel summary that the @BRADLOGS / BRADMAX aggregator distributes inside !! 2025 NOV.part001.rar packs. Per-victim folders follow the
[<TAG>]@BRADLOGS (BRADMAX) (<NN>)/Information.txt layout.
Every value is written on its own line, padded with blank
lines on both sides, and a ---+---+---+---+---+---+---
dash-plus rule separates the panel-summary block from a
three-line trailing block of opaque Facebook-Ads-Manager
artefacts.
The panel-summary block carries country : City-Region-CC
with a space before the colon, an ID : value shaped like a
15-digit Facebook user ID, a bare
Windows-<major>-<release>-<build>-SP0 line in the Python
platform.platform() shape, a Username: line, and a
pipe-separated CK: <n> | Card: <n> count line. The trailing
block ships three values: a short alpha token, an integer, and
a T- prefixed 18-digit number (likely Facebook page
initials, page-likes count, and ad-account ID, though the
schema has no slot for these so they are dropped at parse
time). Family attribution is provisional pending a published
threat-intel mapping for this layout. The closest documented
relatives are NodeStealer and SYS01, both Facebook-targeting
families, but neither publishes a sample log showing this
exact label set or the ---+---+--- rule.
