CSBradMaxCloudBannerOnlyStealer is a CyStack-coined
identifier for a banner-only system_info.txt shape
distributed through the @bradmax_cloud Telegram channel.
The file ships the aBradMax Figlet banner inside a
*-bordered frame with the
Telegram: https://t.me/BRADMAX_CLOUD watermark and
nothing else: no Key: Value field block, no section
separators, no installed-software inventory or environment-variable dump. The underlying stealer panel template
emitted the header but the field-population step failed
(operator-side normalization failure, anti-leech truncation, or
the source log was captured mid-write).
Observed inside !! 2024 MAY.part01.rar packs at
<CC>_<IPv4>_<YYYY>_<MM>_<DD>_<HH>_<MM>_<SS>/ /system_info.txt victim folders (e.g.
CZ_<IPv4>_2024_04_22_16_05_20/system_info.txt).
The all-underscore timestamp separators distinguish this
folder shape from the Mars-fork sibling that puts a space
between the date and time components. The file basename
system_info.txt (underscore + lowercase) is distinct
from the system.txt / System.txt / Information.txt
filenames the other four BRADMAX_CLOUD slices use, but
the fingerprint relies on body content rather than the filename
so that variant filenames carrying the same banner-only
body remains identifiable.
