CSGeoSysInfoStealer is a CyStack-coined identifier for
a single-section === SYSTEM INFO === system.txt panel
distributed through the @BRADMAX Telegram channel.
The body carries 8 flat Key: Value lines under one
triple-equals header: Computer, User, OS, IP,
Country, CPU, GPU, RAM. Hardware fields are
present but typically empty on observed bodies; the
OS value is the literal placeholder Windows 10/11
rather than a real version string.
The format shares the === SYSTEM INFO === header with
CSStatsSectionStealer (iteration #34) but ships an
entirely different field set and no second STATS
section. Same operator channel @BRADMAX but a
different builder.
Variants observed: 1
Top attribution confidence: unknown
Distribution channels: @BRADMAX
- Browser saved credentials and cookies
- IP and geo fingerprint
- System hardware and OS inventory
Distribution channel: @BRADMAX
Attribution confidence: unknown
Field keys:
CPU, Computer, Country, GPU, IP, OS, RAM, User
Filenames: system.txt
Sample (sanitized):
=== SYSTEM INFO ===
Computer: JACKSON
User: jacks
OS: Windows 10/11
IP: <redacted>
Country: The Netherlands (NL)
CPU:
GPU:
RAM:
The header === SYSTEM INFO === plus the IP + Country
geo block plus the bare-key hardware tail is the
fingerprint. The negative anchor on === STATS ===
separates this panel from CSStatsSectionStealer, which
uses the same header but adds a count section. The
OS: Windows 10/11 literal placeholder is a strong
tell that the panel never enumerated the actual
version, useful as a triage signal.