TF-2020203
high
📛 Threat Title
StrelaStealer: Domain name that delivers a malware payload book.sabrina.lordlamer.de
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: StrelaStealer. Confidence: 100. First seen: 2026-11-08 05:36:31 UTC. Reporter: threatcat_ch. Tags: StrelaStealer.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
book.sabrina.lordlamer.de
UrlVoid 2 / 36
IOC database
- Type
- domain
- Value
book.sabrina.lordlamer.de- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to StrelaStealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: StrelaStealer. Confidence: 100. First seen: 2026-11-08 05:36:31 UTC. Reporter: threatcat_ch. Tags: StrelaStealer.
Remediations (10)
-
web:assets.kpmg.com
Communicates with its Command and Control (C2) server, StrelaStealer sends stolen email login data back to the attacker. The C2 server name is defined in the malware configuration. StrelaStealer's continuous evolution in email campaigns and DLL payload highlights the imperative for robust cybersecurity measures to mitigate & prevent future ...
-
web:attack.mitre.org
StrelaStealer is an information stealer malware variant first identified in November 2022 and active through late 2024. StrelaStealer focuses on the automated identification, collection, and exfiltration of email credentials from email clients such as Outlook and Thunderbird.
-
web:brandefense.io
This report contains a technical analysis of the malware known as StrelaStealer . StrelaStealer is a type of malware designed to steal user information, specifically targeting credentials linked to email applications. Initial access is typically achieved through obfuscated JavaScript or BAT files delivered to the target via phishing emails.
-
web:threatlabs.netskope.com
StrelaStealer is an information stealer that targets email credentials, harvesting saved passwords from Outlook, Thunderbird, and browsers on infected systems. Its operators deliver it through phishing campaigns that hit organizations across Europe and North America, and stolen email access fuels invoice fraud and further phishing.
-
web:unit42.paloaltonetworks.com
Introduction to StrelaStealer StrelaStealer malware is an email credential stealer first documented by DCSO_CyTec in their blog on Medium published on Nov. 8, 2022. Since the first emergence of the malware , the threat actor behind StrelaStealer has launched multiple large-scale email campaigns, typically across the EU and U.S. For example, the last large-scale campaign launched in 2023 was ...
-
web:www.csirt.cy
Delivery Method: The primary delivery method is phishing emails. The infection chain of StrelaStealer involves phishing emails with attachments that execute the malware payload . In earlier versions, the malware was spread via .iso files containing .lnk and HTML files, utilizing polyglot files to evade detection.
-
web:www.ibm.com
IBM X-Force has been tracking ongoing Hive0145 campaigns delivering Strela Stealer malware for over a year. Learn more about the malware , the techniques for spreading it, and how to protect against it.
-
web:www.infoblox.com
30k sites infected with DNS malware by Detour Dog. Now linked to Strela Stealer, StarFish backdoor, REM Proxy, and Tofsee in global spam campaigns.
-
web:www.microsoft.com
Command: Certutil -f decode Magnificentdevelopment Final Payload Analysis The final payload of StrelaStealer is used to steal email credentials. It contains a string strela which is the identity of StrelaStealer malware . When decoded we get the URL just after "strela" and location of server page which captures stolen data.
-
web:www.mycert.org.my
The primary objective of StrelaStealer is to pilfer email login credentials from popular email clients and transmit them back to the Command and Control (C2) server specified in the malware configuration. Figure 10: StrelaStealer string as well as C2 server name . The StrelaStealer threat actor has introduced several significant modifications.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.