CSDualArchStealer is a CyStack-coined identifier for a minimal
6-field Info.txt panel with a bare System Information:
section header and dual Process Architecture: + OS Architecture: fields. Observed inside @BRADMAX 12000 FEB-MARCH.part1.rar at @BRADMAX <count> <MONTHS>/[<CC>]@BRADMAX (<N>)/ Info.txt victim folders (e.g.
[UN]@BRADMAX (140)/ Info.txt).
The body ships exactly seven lines: a section-header line
System Information: followed by six Key: Value fields.
Each field maps directly to a .NET Environment class
property: OS: (WMI or
Environment.OSVersion.VersionString), Machine Name:
(Environment.MachineName), User Name:
(Environment.UserName), Current Directory:
(Environment.CurrentDirectory), Process Architecture:
(Environment.Is64BitProcess rendered as x64 / x86), OS Architecture: (Environment.Is64BitOperatingSystem rendered
as x64 / x86). The Current Directory value in the
observed sample points at PowerShell as the execution context
(C:\Windows\system32\WindowsPowerShell\v1.0), suggesting a
PowerShell-based dropper chain.
Extremely minimal - no hardware inventory, no identity fields
beyond hostname and short-username, no timestamps. The panel
is a small .NET Environment-query snapshot rather than a full
stealer log.
Family attribution is provisional pending a published
threat-intel mapping. Public reporting and community
catalogues do not attest a family emitting exactly this
6-field layout with the dual architecture pair.
