Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSSoftwareTailStealer

Also known as:BRADMAX heavily-stripped information.txt tailBare-exe + `[Software]` marker labeling artifact

What is the CSSoftwareTailStealer infostealer, and what data does it steal?

CSSoftwareTailStealer (also known as BRADMAX heavily-stripped information.txt tail and Bare-exe + `[Software]` marker labeling artifact) is a CyStack research label for information-stealer traces. CSSoftwareTailStealer targets Running process names (no PIDs preserved) and Installed Windows applications with version strings. As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSSoftwareTailStealer is a CyStack-coined identifier for a heavily-stripped information.txt panel tail distributed through the @BRADLOGS / BRADMAX Telegram channel inside !! 2025 NOV.part001.rar packs at [<TAG>]@BRADLOGS (BRADMAX) (<NN>)/information.txt victim folders. The body opens with a bare <exe>.exe process list (no tab indent, no [<PID>] annotation), then the Vidar-canonical [Software] section marker appears concatenated onto the last process entry as <exe>.exe [Software] rather than on its own line. Versioned-app entries follow in <Name> - <Version> form. No system info block, no IP / Country / Computer Name / HWID / Local Time field survives.

The [Software] section header is Vidar-canonical per public Vidar Stealer write-ups, but the heavily-stripped body carries no other Vidar fingerprint field (no VideoCard:, Work Dir:, Keyboard Languages:, Local Time:, Windows: / AV: pair). Family attribution is provisional pending a published threat-intel mapping for this layout. The structural similarity to Vidar is suggestive but not sufficient for direct Vidar attribution: the BRADMAX aggregator resells multiple stealer families under a shared redistribution shell, and any panel that emits a Vidar-style section marker as the only signal could come from a Vidar fork or an unrelated builder.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Panel name	Distribution channel	Confidence
br********	Telegram	Unknown

Data is masked to protect the community

The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`6923df9...`	301	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence