CRITICAL: StealC Historical Bot Infections Special Report

Fields

• timestamp
  The timestamp has been set to "2026-06-24 00:00:00", to represent when this one-off data set was distributed.
• ip
  IP address of the affected device. In this case, the last IP address an infected victim bot was using at the last seen time (note that the bot may have changed IP addresses over time, but only the last seen IP address is available)
• port
  TCP or UDP port identified (unused)
• protocol
  Protocol associated with the malicious activity (unused)
• asn
  Autonomous System Number of the affected device
• geo
  Country of the affected device
• region
  Region of the affected device
• city
  City of the affected device
• hostname
  Hostname of the affected device (may be from reverse DNS)
• naics
  North American Industry Classification System Code
• sector
  Sector of the IP in question
• tag
  Additional tags for more insight
• infection
  Description of the malware/infection
• public_source
  Source of the data
• status
  Status of the affected IP, for example, "infected" (was historically infected with the StealC malware)
• detail
  URL to obtain more detail
• account
  The Microsoft Windows user name of the infected users on the infected victim system
• method
  Request method (unused)
• severity
  Severity level
• hostname_source
  Hostname source
• first_seen_time
  The time an infected victim bot was first seen by the StealC backend. Note: first_seen_time is based on the time reported by the infected client when the StealC malware was first executed and credentials were stolen on the victim computer. That date was stored by StealC in a file containing system information (called system_info.txt) and is based on the local time reported by the victim's computer at that time, not a centralized server clock. Some infected devices may have had broken or inaccurate local system clocks, so the first_seen_time value provided can only be as accurate as the local computer system clock. We believe this data was likely stolen from infected victim systems during the period between 4th July 2025 and 16th June 2026.
• last_seen_time
  The time an infected victim bot was last seen by the StealC backend (note that there could have been multiple infections, but only the last seen time is available). Note: last_seen_time is based on the time reported by the infected client when the StealC malware was last executed and/or credentials were stolen on the victim computer. That date was stored by StealC in a file containing system information (called system_info.txt) and is based on the local time reported by the victim's computer at that time, not a centralized server clock. Some infected devices may have had broken or inaccurate local system clocks, so the last_seen_time value provided can only be as accurate as the local computer system clock. We believe this data was likely stolen from infected victim systems during the period between 4th July 2025 and 16th June 2026.
• potential_exposure_time
  The number of seconds between first and last seen times for this bot (note comments above about the potential inaccuracy of the first_seen_time and last_seen_time values due to the data being based on the locally reported system clock time)
• machine_name
  The machine name of the infected victim system
• url
  The URL captured by the StealC information stealing malware
• login
  The login user name or other identifying credential captured by the StealC information stealing malware
• password
  The password captured by the StealC information stealing malware, redacted with ****s for most characters (to allow local verification)
• password_sha1
  The SHA1 hash of the password captured by the StealC information stealing malware, redacted as the first half of the hash only (to allow local verification)
• password_ntlm
  The Windows NTLM hash of the password captured by the StealC information stealing malware, redacted as the first half of the hash only (to allow local verification)
• estimated_server_first_seen_time
  The estimated time an infected victim bot was first seen by the StealC backend. Note: as per comments on first_seen_date above, this time was not recorded on the server using its own clock, but has been added here using an estimate based on other data artifacts available from the server.
• estimated_server_last_seen_time
  The estimated time an infected victim bot was last seen by the StealC backend. Note: as per comments on last_seen_date above, this time was not recorded on the server using its own clock, but has been added here using an estimate based on other data artifacts available from the server.