Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSFlatRemusStealer Infostealer Analysis: Targets & TTPs

CSFlatRemusStealer

Also known as:Flat-key Remus-vocabulary Info.txt panelBRADMAX stripped Remus YAML variant

What is the CSFlatRemusStealer infostealer, and what data does it steal?

CSFlatRemusStealer (also known as Flat-key Remus-vocabulary Info.txt panel and BRADMAX stripped Remus YAML variant) is a CyStack research label for information-stealer traces. CSFlatRemusStealer targets Malware install path (WinRAR temp-extraction `Rar$EX...` folder in observed samples), Country code (ISO 3166-1 alpha-2), OS caption with build number, System locale (`fr-FR` / `en-US` / etc.) and Windows domain / netbios name (empty in observed sample). As of 11/10/2026, CyStack's research records 1 variant distributed through 2 channels, with low attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSFlatRemusStealer is a CyStack-coined identifier for a heavily-stripped Info.txt panel whose Remus-vocabulary YAML keys have been flattened to root level with no build: / os: / hardware: block wrappers. Observed inside @BRADMAX 14000 MARCH.part01.rar Telegram aggregator packs at @BRADMAX <count> <MONTH>/ [<CC>]<IPv4>/Info.txt victim folders (e.g. @BRADMAX 14000 MARCH/[DZ]<IPv4>/Info.txt).

The nine root-level keys (path, country, os, version, language, domain, cpu, ram, gpu) match Remus Stealer's YAML manifest vocabulary verbatim, but the panel writer collapsed the canonical nested structure into a flat key list. Both the block wrappers (os, cpu, ram, gpu) and their would-be children (version, language, domain) sit at column 0 as sibling root keys. Most values are empty because the panel-side collection failed for hardware fields, leaving only path, country, and version populated.

Public writeups confirm that Remus Stealer emits its victim manifest as YAML with these exact key names, and public channel catalogues attest BRADMAX as a Remus / Lumma / DCRat / Mars redistribution channel. The field-vocabulary and distribution-channel corroboration gives medium confidence in Remus lineage, but no Remus-canonical identity anchor (ip-address:, elevated:, HWID:, Computer Name:) survives in this flat variant to pin attribution. Family attribution stays CyStack-coined with low confidence pending a published Remus sample of this exact flat serialisation.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Operator panels & distribution channels

2 distinct distribution channels recorded for this malware

Panel name	Distribution channel	Confidence
—	Telegram	Low
—	Telegram	Low

Data is masked to protect the community

The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`e9071d2...`	1	Low

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence