StealedStealed Documentation
Open Stealed
API ReferenceInfostealer

The sheet of one stolen machine: a summary, rubrics on demand

GET
/api/v1/machines/{machine_hash}

One machine: the union, deduplicated by natural key, of ALL the copies (logs) of the machine linked to its anchor credential (the 10 most recent, copies_total counts them all). By default a summary: the profile (of the most complete copy), the copies with the rows each holds, the figures (kpis), and for each rubric its total. Ask for rows with include (credentials, cookies, tokens, windows_credentials, cards, software, processes, environment, or all) and bound them with limit; each rubric is {included, total, truncated, items} and truncated is total > limit. A rubric's own route (/credentials, /cookies...) pages through all of it.

limit is 10 by default and 200 at most for an API key (422 above, never a silent cut); a session may ask up to 10 000. Environment variables come with their value for a few benign Windows variables only: every other one is listed by name with value null and masked true.

Without hash the server resolves the machine's anchor credential itself; with it, that credential is checked and anchors the machine (another anchor can give another group of copies). Answers 404 when the machine is not in the perimeter of the client looked at, or the credential is not on it. A credential on the client's domains shows its password fingerprint only. source of a copy is null unless the organisation has the source_reveal feature, and always for an API key.

credentials also has undetailed: the credentials linked to the machine that are not in the registry, which cannot be listed (no site, no user); total counts the listed ones only. A credential says on_your_domains when its site, its e-mail domain or a routed pair is the client's, and root_is_yours when its site's own root domain is.

Never returns a secret (a cookie value, a Windows password, a card number), never the source of a log for an API key, and never a password of a third party. Every call is written to the access journal as machine.read. An API key's call is counted against the daily and monthly quota of its workspace, refusals included.

Authorization

ApiKeyAuth
X-API-Key<token>

API key for authentication

In: header

Path Parameters

machine_hash*Machine Hash

The machine: any of its logs, as machine_hash of the list says (32 hex characters, any case).

Match^[0-9a-fA-F]{32}$

Query Parameters

hash?|

Optional: a credential of the tenant that is on this machine (32 hex characters, any case). Without it the server takes the smallest credential of the tenant on the machine itself and checks it exactly the same way; the machine is then open to the same people. With it, that credential is checked instead and anchors the machine: a credential that is not in the perimeter, or not on this machine, is refused (404) with no fallback to another.

include?|

The rubrics to embed, comma-separated, among credentials, cookies, tokens, windows_credentials, cards, software, processes, environment, or all. Absent: the summary (every rubric with included false and its total).

limit?Limit

Rows embedded per rubric. 10 by default; 200 at most for an API key (422 above), 10 000 for a session.

Default10
Range1 <= value <= 10000

Response Body

application/json

curl -X GET "https://api.stealed.io/api/v1/machines/string"
{
  "cards": {
    "included": true,
    "items": [],
    "total": 0,
    "truncated": false
  },
  "cookies": {
    "included": true,
    "items": [
      {
        "browser": "Edge",
        "copies": 2,
        "expired": false,
        "expires_at": "2026-12-01T10:00:00Z",
        "has_secret": true,
        "host": ".example-assurance.fr",
        "is_secure": true,
        "is_session": true,
        "machine_hash": "25fce7533a0b41d9e8c26f04b71a9d52",
        "name": "MSISAuth",
        "on_your_domains": true,
        "path": "/",
        "root_domain": "example-assurance.fr",
        "secret_id": "ck_5b0c1f2a9e7d4c3b8a61d0f2"
      }
    ],
    "total": 2104,
    "truncated": false
  },
  "copies": [
    {
      "collected_on": "2026-09-06",
      "computer_name": "LT-ACME-0412",
      "country": "FR",
      "exclusive": {
        "cards": 0,
        "cookies": 2104,
        "credentials": 380,
        "tokens": 1,
        "windows_credentials": 1
      },
      "hwid": "4C4C4544-0052-3510-8048-B4C04F4D3732",
      "identical_to": [
        "7d0e5a21c48f93b6e0a1d2c3b4f56789"
      ],
      "log_date": "2026-09-04",
      "machine_hash": "25fce7533a0b41d9e8c26f04b71a9d52",
      "rows": {
        "cards": 0,
        "cookies": 2104,
        "credentials": 380,
        "tokens": 1,
        "windows_credentials": 1
      },
      "source": {
        "channel": "Example Cloud",
        "file_name": "Example_Cloud_81.rar"
      },
      "stealer_family": "redline"
    },
    {
      "country": "FR",
      "exclusive": {
        "cards": 0,
        "cookies": 2104,
        "credentials": 380,
        "tokens": 1,
        "windows_credentials": 1
      },
      "identical_to": [
        "25fce7533a0b41d9e8c26f04b71a9d52"
      ],
      "log_date": "2026-08-19",
      "machine_hash": "7d0e5a21c48f93b6e0a1d2c3b4f56789",
      "rows": {
        "cards": 0,
        "cookies": 2104,
        "credentials": 380,
        "tokens": 1,
        "windows_credentials": 1
      }
    }
  ],
  "copies_total": 2,
  "copies_truncated": false,
  "credentials": {
    "included": true,
    "items": [
      {
        "copies": 2,
        "first_seen": "2026-09-06",
        "hash": "a3f9c2e17b4d08f6c29e51a07d3b6e84",
        "host": "portail.example-assurance.fr",
        "last_seen": "2026-09-18",
        "on_your_domains": true,
        "origin": true,
        "password_fp": "3fa91c07b2de",
        "root_domain": "example-assurance.fr",
        "root_is_yours": true,
        "types": [
          "Stealer"
        ],
        "username": "[email protected]"
      }
    ],
    "total": 380,
    "truncated": false,
    "undetailed": 41
  },
  "environment": {
    "included": true,
    "items": [
      {
        "key": "OPENAI_API_KEY",
        "masked": true
      },
      {
        "key": "USERDOMAIN",
        "masked": false,
        "value": "ACME"
      }
    ],
    "total": 2,
    "truncated": false
  },
  "first_collected": "2026-08-21",
  "generated_at": "2026-10-03T09:12:41Z",
  "kpis": {
    "cookies": {
      "distinct_hosts": 412,
      "live": 640,
      "on_your_domains": 31
    },
    "credentials": {
      "distinct_identities": 7,
      "on_your_domains": 12
    },
    "software": {
      "processes_instances": 210
    }
  },
  "last_collected": "2026-09-06",
  "machine_hash": "25fce7533a0b41d9e8c26f04b71a9d52",
  "origin_hash": "a3f9c2e17b4d08f6c29e51a07d3b6e84",
  "processes": {
    "included": true,
    "items": [
      {
        "instances": 9,
        "name": "chrome.exe"
      }
    ],
    "total": 1,
    "truncated": false
  },
  "profile": {
    "ad_domain": "ACME.LOCAL",
    "antivirus": "Windows Defender",
    "collected_on": "2026-09-06",
    "computer_name": "LT-ACME-0412",
    "country": "FR",
    "cpu": "Intel(R) Core(TM) i7",
    "gpu": "NVIDIA GeForce RTX 3060",
    "guid": "5b0c1f2a-9e7d-4c3b-8a61-d0f2e4a79c10",
    "hwid": "4C4C4544-0052-3510-8048-B4C04F4D3732",
    "install_path": "C:\\Users\\cbernard\\AppData\\Roaming\\Svc\\svc.exe",
    "ip_address": "192.0.2.37",
    "is_admin": false,
    "local_ips": [
      "10.12.4.87",
      "192.168.1.24"
    ],
    "log_date": "2026-09-04",
    "machine_id": "9f3c0b1e",
    "machine_uid": "hw:4C4C4544-0052-3510-8048-B4C04F4D3732",
    "machine_uid_confidence": "high",
    "machine_user": "cbernard",
    "missing_fields": [
      "city"
    ],
    "network_adapters": [
      "Ethernet",
      "Wi-Fi"
    ],
    "os": "Windows 11 Pro 23H2",
    "ram_mb": 16384,
    "screen": "1920x1080",
    "stealer_family": "redline",
    "system_language": "fr-FR",
    "timezone": "(UTC+01:00) Paris",
    "work_dir": "C:\\Users\\cbernard\\AppData\\Local\\Temp",
    "zip_code": "69003"
  },
  "redacted": false,
  "reveal": {
    "allowed": true
  },
  "software": {
    "included": true,
    "items": [
      {
        "name": "7-Zip 24.08 (x64)"
      }
    ],
    "total": 1,
    "truncated": false
  },
  "tokens": {
    "included": true,
    "items": [
      {
        "copies": 2,
        "domain": "app.example-crm.io",
        "kind": "jwt",
        "label": "[email protected]",
        "on_your_domains": false,
        "software": "Chrome [Default]"
      }
    ],
    "total": 1,
    "truncated": false
  },
  "windows_credentials": {
    "included": true,
    "items": [
      {
        "copies": 1,
        "has_secret": true,
        "machine_hash": "7d0e5a21c48f93b6e0a1d2c3b4f56789",
        "secret_id": "wc_8d41e0a7c2b95f6a13e7d0c4",
        "target": "Domain:target=TERMSRV/srv-rds01.acme.local",
        "user": "ACME\\cbernard"
      }
    ],
    "total": 1,
    "truncated": false
  }
}
Empty
Empty
Empty
Empty
Empty

The stealer logs a leaked credential was found in GET

From a leaked credential already in your tooling (its `hash`, as the leak list gives it): the logs (one per `machine_hash`) it was collected in, most recent first (`log_date` descending, unknown last, then `collected_on`), at most 50. Then open the machine with `GET /machines/{machine_hash}?hash=...`. Answers 404 when the credential is not in the perimeter of the client looked at (same source and domains as the leak list of that view). A credential in the perimeter with no log is not an error: `machines` is empty. `computer_name` is masked like every identity of the leak list when that list masks them. `source` (the archive name, and the Telegram channel when known) is null unless the organisation has the `source_reveal` feature, and never for an API key. An API key's call is counted against the daily and monthly quota of its workspace, refusals included.

The credentials found on a machine, one page at a time GET

Every credential linked to the machine that has a card (site, user, dates), cut and counted in the database, with no cap. Paginated, in the order the sheet sorts them (host, user, hash); `total_pages` is at least 1, past the last page `items` is empty. Same access rule, anchor (`hash`, optional) and masking as the sheet `GET /machines/{machine_hash}`; the `generated_at` of a rubric read from the cached sheet is the build of that sheet, and two calls that answer the same one answer the same page. `on_your_domains` and `root_is_yours` keep the credentials that are, or are not, on the client's domains (the latter: the site's own root domain is the client's); `host` keeps one site. A credential on the client's domains shows its password fingerprint only, never the password. Never returns a secret (a cookie value, a Windows password, a card number), never the source of a log for an API key, and never a password of a third party. Every call is written to the access journal as `machine.read`. An API key's call is counted against the daily and monthly quota of its workspace, refusals included.