---
title: Infostealer-turned-RAT on a Windows endpoint (Stadia/StealC): scope, contain, rotate | ctxsec
url: https://ctxsec.com/playbooks/windows-infostealer-rat-stadia-response
---

[← Playbooks](/playbooks)

# Infostealer-turned-RAT on a Windows endpoint (Stadia/StealC): scope, contain, rotate

What to do when a host shows Stadia-style signs: a hidden 15-minute task under ProgramData, a new Defender exclusion, or suspended-browser injection. Built from Varonis's Oct 22 analysis. Stadia adds hands-on remote access, so treat it as an intrusion, not just a stolen-password cleanup.

For: SOC, IR lead, Endpoint / Windows admin, Identity admin

[1. Confirm and scope](#s1)[2. Contain the host](#s2)[3. Assume every browser secret on that host is stolen](#s3)[4. Hunt the fleet](#s4)

1.

Step 1 of 4

__

### Confirm and scope

Use behavior, because C2 IPs and keys change with each build.

   - Search Security events 4698/4702 for task XML containing Interval PT15M, Duration P3650D, Hidden true and a C:\ProgramData\ path (Varonis Sigma rule)
   - Look for unsigned EXEs in random 12-character ProgramData folders named like updaters (RuntimeBroker, MicrosoftEdgeUpdate, GoogleUpdate, AdobeARM and so on)
   - Check Defender exclusions and PowerShell Add-MpPreference -ExclusionPath events
   - Proxy/NDR: HTTP POSTs to the root path of bare IPs with Content-Type application/json and a Base64 body; for the known build, 93.152.213.215, 91.92.43.45 and 193.148.56.97

2.

Step 2 of 4

__

### Contain the host

The operator may be watching the screen through hidden VNC.

   - Network-isolate through EDR before you remove anything, and preserve memory and the ProgramData folder
   - Remove the scheduled task, the binary and the Defender exclusion, then re-run a full scan
   - The loader can run EXE, PowerShell, CMD or MSI payloads from memory, so check for follow-on tools and reimage if anything else ran

3.

Step 3 of 4

__

### Assume every browser secret on that host is stolen

The stealer module takes saved passwords, cookies and session tokens (including Azure), wallets and messenger data.

   - Revoke sessions and refresh tokens for the user in Entra ID and other SSO, then reset passwords from a clean device
   - Rotate any SaaS, cloud, VPN and developer credentials saved in the browser, and remove unknown MFA methods and devices
   - Tell the user to move crypto wallet funds to new seeds from a clean device

4.

Step 4 of 4

__

### Hunt the fleet

One infected host usually means a shared lure.

   - Run the task, exclusion and network queries across all endpoints
   - Block the published hashes and IPs as a stopgap, and keep the behavioral rules running
   - Review how the payload arrived (download, cracked software, ClickFix). Varonis did not identify a delivery method

Original content by ctxsec. Printable checklist: use your browser's print view.