CSFlatMacProfilerStealer is a CyStack-coined identifier for a
six-field flat Information.txt panel carrying raw macOS
system_profiler output with no section headers. Observed
inside @BRADMAX 14000 MARCH.part01.rar Telegram aggregator
packs at @BRADMAX <count> <MONTH>/[<CC>] UNKNOWN_(<N>)/Information.txt GeoIP-fallback filler-folder
paths (e.g. [FR]UNKNOWN_(4)). This is the first macOS victim
observed inside a BRADMAX pack in the surveyed samples.
The body ships six flush-left Key: Value lines drawn from
system_profiler SPSoftwareDataType (User Name),
SPHardwareDataType (Model Name, Processor Name,
Memory), and SPDisplaysDataType (Chipset Model,
Resolution). The User Name value uses the macOS-canonical
<Real Name> (<login>) parenthesised shape. The Resolution
value includes a human-readable annotation in parentheses
(e.g. 2560 x 1440 (QHD/WQHD - Wide Quad High Definition))
matching system_profiler's output style.
Family attribution is provisional with low confidence.
Multiple canonical macOS stealer families (AMOS / Atomic,
Banshee, Cthulhu, Poseidon, MacSync) shell out to the same
system_profiler subcommands per public writeups. Without a
family-specific banner or section header surviving in this
stripped panel, attribution to any single canonical family is
a guess. Replace this tracking name with the canonical family name when a public writeup later publishes a sample of this
exact six-field stripped variant.
