CSNovyiLogStealer is a CyStack-coined identifier for a
Russian-language info.txt panel observed inside !! 2025 NOV.part001.rar BRADMAX / @BRADLOGS aggregator packs. The
file lands buried inside the victim
AppData/Local/Temp/<8-char-random>/info.txt path, not at a
top-level victim folder. The body opens with the Cyrillic
Новый лог! (New log!) banner that the operator's Telegram
bot posts on every new upload, then a 🗃Build ID: <name>
per-build tag, then a 10-field count panel with Russian field
names and one emoji glyph per line.
Field set: 🏳️ IP, 🌎 Страна (ISO 3166-1 alpha-2 code, not
the country name), 💻 Система (localised Windows product
name), 🍪 Куков (cookies count), 🔐 Паролей (passwords
count), 💳 Карт (cards count), 📥 Загрузок (downloads
count), 📚 Истории (history count), 🎫 Токенов (tokens
count), 👛 Кошельков (wallets count), 📱 Tdata (Telegram
tdata count). The retained research record focuses on the build ID, public
IP, ISO2 country, and OS string; the raw sample preserves the
per-category counts for analyst review.
Family attribution is provisional pending a published
threat-intel mapping for this layout. Public reporting and
community catalogues do not document a stealer that emits this
exact Новый лог! banner with the 10-field emoji panel. A
public Angry Stealer / Rage Stealer write-up describes a
similar field set (cookies + passwords + cards + downloads +
wallets + Tdata) distributed via a Telegram bot, but does not
show the panel format verbatim, so the field-set similarity is
not enough to attribute. The Build ID: Kev1n value is a
per-build operator tag, not a family brand.
