CSUsersListStealer is a CyStack-coined identifier for a
five-line minimal Information.txt panel distributed through
the @BRADLOGS Telegram channel (active mirror of the
@BRADMAX / t.me/bradmax_cloud aggregator that public
channel catalogues list as a "Redline and Raccoon Data Logs"
reseller). Observed at [<TAG>]@BRADLOGS (BRADMAX) (<NN>)/Information.txt victim folders inside !! 2025 JULY.part001.rar packs.
The body is three space-before-colon header lines (HWID : <uuid>, IP : <ipv4>, Users : <comma-list>) followed by
two emoji-prefixed per-category count lines (🔑 Passwords: <n>, 🍪 Cookies: <n>) separated from the header block by
blank-line padding. No hostname, OS, build label, timestamp,
country, or antivirus field is emitted.
The plural Users : line carries every Windows user profile
enumerated from C:\Users\, including the real victim plus
stale TEMP / TEMP.DESKTOP-XXXX / TEMP.DESKTOP-XXXX.000
remnants left behind when LoadUserProfile failed and the OS
created a throwaway profile directory. The multi-profile
enumeration is unique to this panel across the catalog; canonical stealers ship only the current
Environment.UserName value. The plural form points at a
Python builder calling os.listdir(r"C:\Users") rather than a
.NET runtime API.
Family attribution is provisional pending a published
threat-intel mapping. Community stealer-format catalogues do
not document a family that emits this exact five-line
space-before-colon shape with a plural-profile Users : line
and 🔑 / 🍪 per-category count tail. The closest documented
relative is LucaStealer, whose summary format uses ✅/❌
count indicators rather than the 🔑 / 🍪 category emoji used
here, and which ships no plural-profile Users : enumeration.
The aggregator self-label (Redline / Raccoon) cannot be
trusted because the body lacks every Redline canonical anchor
(Operation System: typo, Hardwares: block) and every
Raccoon canonical anchor (User ID: UUID, Last seen:
JS-date).
