Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Aetheris Stealer (observed self-label) Malware Analysis

CSUserInfoBracketStealer

Also known as:Aetheris Stealer (observed self-label)Banshee v1.4 (observed self-label)PDRstealer (observed self-label)User Info / Input ISO bracket template

What is the CSUserInfoBracketStealer infostealer, and what data does it steal?

CSUserInfoBracketStealer (also known as Aetheris Stealer (observed self-label), Banshee v1.4 (observed self-label), PDRstealer (observed self-label) and User Info / Input ISO bracket template) is a CyStack research label for information-stealer traces. CSUserInfoBracketStealer targets browser credentials, cryptocurrency wallets and System hardware and locale inventory. As of 11/10/2026, CyStack's research records 6 variants, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CyStack tracking name for an unattributed Windows Information.txt template built from [User Info], [Network], [System], [Drives], [GPU], and [Basic] sections. The same field grammar has been observed with the self-labels AETHERIS, PDRstealer, and Banshee v1.4, and with no surviving banner. The AETHERIS-labelled observation carries the Developer @sexyweekly watermark and was distributed in an @BRADMAX-style pack. These labels are retained only as per-variant panel brands.

MITRE ATT&CK technique mapping

T1555Credentials from Password Stores

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Variants (6)

6 variants recorded for this malware

ID	Data collected	Confidence
`910d7bd...`	1	Unknown
`97e6d92...`	1	Unknown
`b5830fa...`	613	Unknown
`e4ecc88...`	4,755	Unknown
`fa73756...`	1	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Sample log format

1User: <value>2Machine: <value>3Now: <value>4Input ISO: <value>5Hwid: <value>6Clipboard: <value>7 8External IP: <value>9Internal IP: <value>10Default Gateway: <value>11 12OS Product: <value>13OS Build: <value>14OS Arch: <value>15CPU Name: <value>16Logical Cores: <value>17RAM Total (MB): <value>18RAM Available (MB): <value>19 20User Domain: <value>21CLR Version: <value>