Infostealer Logs Analysis Report

This report examines Top-30 fields extracted from Infostealer logs (Aug–Oct 2024) across ~28.25M infections, identifying attacker build IDs (many linked to Telegram channels), primary infection/injection paths (68.2% .NET Framework paths; common abused executables include regasm.exe, bitlockertogo.exe, msbuild.exe), and victim metadata by country, OS, and user type—providing large-scale profiling of threat actors, common TTPs, and artifact indicators to inform detection and response.