Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSSigInfoStealer

Also known as:BRADMAX Info.txt with Lumma sig watermarkBare-KV Redline-style panel with Lumma sig suffix

What is the CSSigInfoStealer infostealer, and what data does it steal?

CSSigInfoStealer (also known as BRADMAX Info.txt with Lumma sig watermark and Bare-KV Redline-style panel with Lumma sig suffix) is a CyStack research label for information-stealer traces. CSSigInfoStealer targets browser credentials, Host metadata: hostname, NetBIOS, Windows username, language, OS fingerprint with build number and architecture, Hardware inventory: CPU model with cores/threads, GPU, installed RAM, Victim public IP plus ISO country code and Wall-clock and time zone offset. As of 11/10/2026, CyStack's research records 3 variants distributed through 1 channel, with low attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSSigInfoStealer is a CyStack-coined identifier for a bare Key: Value Info.txt panel that carries the Lumma-canonical (sig:UNIX.HEX) watermark on the Time: line while using Redline-style verbose field naming for the rest of the body. Observed inside !! 2025 NOV.part001.rar @BRADLOGS / BRADMAX aggregator packs in [<CC>]<IP>/Info.txt victim folders (e.g. [CA]<IPv4>/Info.txt).

Body fields: Build Date, Configuration, Execution Path, Elevated, Computer Name, User Name, User Language, Netbios, Operation System (sic typo), Install Date, System Date, Time Zone, Antivirus, HWID, Processor, Processor Threads, Processor Cores, Graphics Card, Installed RAM, Display Resolution, IP Address, Time, Country, User. The body is flat (no leading-dash prefix unlike Lumma / Deimos / BABA / DarkSide / AL Stealer), no operator banner (unlike Redline), and not YAML (unlike Remus). Family attribution is provisional pending a published threat-intel mapping for this exact bare-KV layout.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Panel name	Distribution channel	Confidence
—	Telegram	Low

CSSigInfoStealer Infostealer Analysis: Targets & TTPs

Variants (3)

3 variants recorded for this malware

ID	Data collected	Confidence
`0816572...`	1	Low
`571b973...`	10,811	Low
`7a05ee4...`	1	Low

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Sample log format

1Build Date: <value>2Configuration:3Execution Path: <value>4Elevated: <value>5Computer Name: <value>6User Name: <value>7User Language: <value>8Netbios: <value>9Operation System: <value>10Install Date: <value>11System Date: <value>12Time Zone: <value>13Antivirus:<value>14HWID: <value>15Processor: <value>16Processor Threads: <value>17Processor Cores: <value>18Graphics Card:19Installed RAM: <value>20Display Resolution: <value>21 22IP Address: <value>23Time: <value>24Country: <value>25User: <value>

CSSigInfoStealer

What is the CSSigInfoStealer infostealer, and what data does it steal?

Description

Accelerate investigation with professional monitoring solutions

Operator panels & distribution channels

Data is masked to protect the community

MITRE ATT&CK technique mapping

Variants (3)

Data limited to 5 variants

Common field keys

Sample log format