Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSPcNameSnakeStealer Infostealer Analysis: Targets & TTPs

CSPcNameSnakeStealer

Also known as:BRADMAX minimal snake_case system_info.txt11-field pc_name/mac/hwid snake_case panel

What is the CSPcNameSnakeStealer infostealer, and what data does it steal?

CSPcNameSnakeStealer (also known as BRADMAX minimal snake_case system_info.txt and 11-field pc_name/mac/hwid snake_case panel) is a CyStack research label for information-stealer traces. CSPcNameSnakeStealer targets Windows username, Host metadata: hostname (pc_name), MAC address, HWID UUID, OS fingerprint via Python `platform.platform()` output, Hardware inventory: CPU model, GPU model, RAM size and Victim public IP plus country / city (placeholder Unknown when geo-IP fails). As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSPcNameSnakeStealer is a CyStack-coined identifier for an eleven-line minimal system_info.txt panel distributed through the @BRADLOGS / BRADMAX Telegram channel inside !! 2025 NOV.part001.rar packs at [<TAG>]@BRADLOGS (BRADMAX)/system_info.txt victim folders. The body is a flat key: value block with all-lowercase snake_case keys and short-form field abbreviations: username, pc_name, os, ram, cpu, gpu, mac, hwid, ip, country, city. The os: value is the Python platform.platform() dash-joined shape (Windows-10-10.0.19045-SP0), and the hwid: value is the classic Windows GetSystemUUID format (8-4-4-4-12 hex with dashes, trailing segment matching the mac: value with dashes stripped).

When the panel cannot resolve geo-IP, it emits the literal Unknown placeholder for ip, country, and city. The Python-builder OS shape pairs this format with CSPyHostTimeStealer as a sibling panel that the same @BRADLOGS / BRADMAX aggregator distributes; this eleven-key variant carries richer device metadata (MAC, HWID, CPU, GPU, RAM) but omits the timestamp. Family attribution is provisional pending a published threat-intel mapping for this layout.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Panel name	Distribution channel	Confidence
br********	Telegram	Unknown

Data is masked to protect the community

The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`a518f20...`	23	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence