Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSDateCreatedStealer

Also known as:BRADMAX Pass.txt with Date Created field5-line URL/Username/Password/Date Created/Application block

What is the CSDateCreatedStealer infostealer, and what data does it steal?

CSDateCreatedStealer (also known as BRADMAX Pass.txt with Date Created field and 5-line URL/Username/Password/Date Created/Application block) is a CyStack research label for information-stealer traces. CSDateCreatedStealer targets browser credentials, Source browser profile name (`Default` / `Profile <n>`), Per-credential creation timestamp from `Login Data` SQLite and Chrome-synced Android app credentials (`android://` package URLs). As of 11/10/2026, CyStack's research records 1 distribution channel, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSDateCreatedStealer is a CyStack-coined identifier for a 5-line URL / Username / Password / Date Created / Application cred-file format distributed inside !! 2025 NOV.part001.rar @BRADLOGS / BRADMAX aggregator packs in [<TAG>]<IP>/Pass/Pass.txt victim folders. The per-entry Date Created: creation-timestamp line wedged between Password: and Application: is the disambiguating signal: no other registered cred-file shape includes a per-credential creation timestamp.

The Date Created: value uses a US-locale M/D/YYYY, H:MM:SS AM/PM format. The Application: line carries a bare browser-profile name (Default, Profile 2) with no bracketed annotation (distinct from CSAppProfileStealer, which uses Application: Chrome [Profile: Default]). Records are separated by a blank line. The panel preserves Chrome-synced Android-app credential URLs in the android://<base64>@com.<pkg>/ form alongside HTTPS desktop URLs, indicating the underlying stealer reads Chromium's Login Data SQLite directly rather than filtering by URL scheme. Family attribution is provisional pending a published threat-intel mapping for this layout. The format resembles the publicly documented PXA Stealer Vietnamese-targeting cred dumps (PXA targets Chromium and Android credentials), but no public write-up shows a sample log with the verbatim 5-line Date Created: layout.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Panel name	Distribution channel	Confidence
—	Telegram	Unknown

Data is masked to protect the community

The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

CSDateCreatedStealer Infostealer Analysis: Targets & TTPs