en
@BRADMAX system_info.txtCSEnvVarDumpStealer (also known as @BRADMAX system_info.txt) is a CyStack research label for information-stealer traces. CSEnvVarDumpStealer targets browser credentials, System hardware and locale inventory, Verbatim Win32 environment-variable dump and Antivirus product enumeration. As of 11/10/2026, CyStack's research records 1 variant distributed through 2 channels, with unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSEnvVarDumpStealer is a CyStack-coined identifier for a
.NET-based stealer panel whose system_info.txt opens with a
=== SYSTEM INFORMATION === header followed by a === ENVIRONMENT VARIABLES === block that dumps the full Win32
environment table verbatim. Distributed through the @BRADMAX
Telegram aggregator (public channel catalogues list
t.me/bradmax_cloud as a Redline / Raccoon Data Logs
channel), with per-victim folders named [<CC>]@BRADMAX (<N>)/.
Distinctive to this panel are the CLR Version: and .NET Runtime: fields (pointing to a .NET builder), the Default Gateway: / Antivirus: / Local IP: triple, and a verbatim
Win32 environment dump as the second section. A panel bug
emits RAM: NoSystemBattery (100%) as a duplicate RAM:
line: a battery-detection result mislabeled with the RAM key.
The NoSystemBattery (100%) literal is shared with
Stealerium's Info.txt BATTERY: field per a community
stealer-format catalogue, but Stealerium's layout uses
bracket-titled [Machine] / [Virtualization] sections,
never the === triple-equals headers seen here, so the
relationship is at most a snippet lift, not a fork.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
2 distinct distribution channels recorded for this malware
| Panel name | Distribution channel | Confidence |
|---|---|---|
| — | Telegram | Unknown |
| — | Telegram | Unknown |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
1 variant recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
7ba734c... | 875 | Unknown |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
Timestamp: <value>Computer Name: <value>OS Version: <value>User Name: <value>System Directory: <value>Processor Count: <value>CLR Version: <value>System Version: <value>Default Gateway: <value>Antivirus: <value>Local IP: <value>CPU: <value>GPU: <value>RAM: <value>SCREEN: <value>RAM: <value> Path = <value>PATHEXT = <value>USERDOMAIN = <value>PROCESSOR_ARCHITECTURE = <value>ProgramW6432 = <value>DriverData = <value>PUBLIC = <value>APPDATA = <value>windir = <value>LOCALAPPDATA = <value>CommonProgramW6432 = <value>OneDrive = <value>USERPROFILE = <value>ProgramFiles = <value>PROCESSOR_LEVEL = <value>CommonProgramFiles(x86) = <value>HOMEPATH = <value>COMPUTERNAME = <value>PROCESSOR_ARCHITEW6432 = <value>USERNAME = <value>PROCESSOR_IDENTIFIER = <value>NUMBER_OF_PROCESSORS = <value>POWERSHELL_DISTRIBUTION_CHANNEL = <value>SystemRoot = <value>ComSpec = <value>LOGONSERVER = <value>TEMP = <value>ProgramFiles(x86) = <value>CommonProgramFiles = <value>TMP = <value>USERDOMAIN_ROAMINGPROFILE = <value>PROCESSOR_REVISION = <value>PSModulePath = <value>ALLUSERSPROFILE = <value>SystemDrive = <value>OS = <value>ProgramData = <value>HOMEDRIVE = <value>
