en
BRADMAX Important Files only bundleBRADMAX 1-dir victim folderCSImportantFilesOnlyStealer (also known as BRADMAX Important Files only bundle and BRADMAX 1-dir victim folder) is a CyStack research label for information-stealer traces. CSImportantFilesOnlyStealer targets Random victim-Documents / Desktop text notes swept by the underlying stealer's file-grabber module. As of 11/10/2026, CyStack's research records 1 distribution channel, with unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSImportantFilesOnlyStealer is a CyStack-coined
identifier for the most-stripped BRADMAX-redistributed
per-victim [<CC>]<IPv4> folder shape that ships a
single Important Files/ subdirectory at root plus
the BRADMAX packer's empty-name DIR artifact. Harvested
content lives under Important Files/<subfolder>/ <name>.txt, typically random Documents/ and
Desktop/ text notes swept off the victim host.
Observed inside 2024-era BRADMAX aggregator packs at
!! <YYYY> <MONTH>/@BRADMAX <count> <MONTH>/ [<CC>]<IPv4>/ paths, distinct from the newer
@BRADLOGS (BRADMAX) (<NN>)/ per-victim shape.
The layout has no Browsers/ per-browser credential
section, no aggregate Passwords.txt or
All Passwords.txt, and no System.txt /
Information.txt system fingerprint - the
aggregator kept only the harvested-files bucket. The
underlying stealer family that captured the original
log cannot be recovered from this stripped shape
because the BRADMAX channel resells multiple families'
logs under a single packer.
1 distinct distribution channel recorded for this malware
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| Panel name | Distribution channel | Confidence |
|---|---|---|
| — | Telegram | Unknown |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
