CSBareVersionStealer is a CyStack-coined identifier for a
UserInformation.txt shape observed inside !! 2026 JAN.part01.rar-style aggregator packs in [CC]@BRADMAX (<N>)/UserInformation.txt victim folders. Public
Telegram-channel catalogues list t.me/bradmax_cloud and the
active t.me/+0IAf5VIrl_EzNWRi mirror as a Telegram
aggregator the operator self-labels "Redline and Raccoon Data
Logs", but the body lacks every Redline canonical anchor
(Operation System: typo, FileLocation:, Hardwares:
block, Anti-Viruses: block) and every Raccoon canonical
anchor (User ID: <UUID>|<user>, JS-date Last seen:, IP info: <CC> <IPv4>), so the operator label cannot be trusted.
The body is structurally a stripped sibling of
CSBuildBlockStealer: same 12-field shape (User time:,
HWID:, PC Name:, User Name:, CPU:, GPU:, Memory:,
OS:, Active window:, Admin rights:, IP:, GEO:) but
with the four-line Build Path: / Build ID: / Build Version: / Build Comment: group replaced by a single bare
Version line (no colon, no value), and the trailing
Resolution: line dropped. Empty IP: / GEO: values are
routine: the panel skips the geolocation lookup on bogon IPs
rather than emit a placeholder string.
Family attribution is provisional pending a published
threat-intel mapping for this stripped layout. Public
reporting and community catalogues do not document a stealer
that emits exactly this stripped-Build / bare-Version field
set.
