TF-1982209
high
📛 Threat Title
StrelaStealer: Domain name that delivers a malware payload wpdemo.iranhostdir.ir
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: StrelaStealer. Confidence: 100. First seen: 2026-10-23 16:24:02 UTC. Reporter: threatcat_ch. Tags: StrelaStealer.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
wpdemo.iranhostdir.ir
VT 1 / 92
UrlVoid 1 / 36
IOC database
- Type
- domain
- Value
wpdemo.iranhostdir.ir- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to StrelaStealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 1 of 92 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| Certego | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| TLD | ir |
History
| Last analysis | 2026-10-23 16:50 UTC |
| Last modified on VirusTotal | 2026-10-23 17:05 UTC |
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: StrelaStealer. Confidence: 100. First seen: 2026-10-23 16:24:02 UTC. Reporter: threatcat_ch. Tags: StrelaStealer.
Remediations (10)
-
web:attack.mitre.org
StrelaStealer is an information stealer malware variant first identified in November 2022 and active through late 2024. StrelaStealer focuses on the automated identification, collection, and exfiltration of email credentials from email clients such as Outlook and Thunderbird.
-
web:docs.cyberark.com
Defend against StrelaStealer malware attacks This topic provides a comprehensive overview of StrelaStealer malware attacks, and outlines the potential risks and impact on user security. It focuses on how to use EPM threat protection policies to implement protective measures and strengthen your email accounts against this emerging cyber threat.
-
web:ismalicious.com
5,095 indicators of compromise attributed to the StrelaStealer malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.
-
web:maltiverse.com
StrelaStealer is an information stealer malware variant first identified in November 2022 and active through late 2024. StrelaStealer focuses on the automated identification, collection, and exfiltration of email credentials from email clients such as Outlook and Thunderbird.
-
web:www.aryaka.com
Strela Stealer, a sophisticated information-stealing malware , is designed to exfiltrate sensitive user credentials, primarily targeting email and web browser data. This malware spreads through phishing emails containing malicious attachments, typically disguised as legitimate documents. Once executed, Strela Stealer extracts stored login credentials from critical end-user applications and web ...
-
web:www.csirt.cy
Delivery Method: The primary delivery method is phishing emails. The infection chain of StrelaStealer involves phishing emails with attachments that execute the malware payload . In earlier versions, the malware was spread via .iso files containing .lnk and HTML files, utilizing polyglot files to evade detection.
-
web:www.ibm.com
IBM X-Force has been tracking ongoing Hive0145 campaigns delivering Strela Stealer malware for over a year. Learn more about the malware , the techniques for spreading it, and how to protect against it.
-
web:www.infoblox.com
30k sites infected with DNS malware by Detour Dog. Now linked to Strela Stealer, StarFish backdoor, REM Proxy, and Tofsee in global spam campaigns.
-
web:www.microsoft.com
The malware spreads through spear phishing emails using legitimate domains as subdomain and malicious as the main domain . The phishing email contains a ZIP attachment, which when downloaded opens the archive, and drops a JavaScript file for further execution. The JavaScript file then drops a batch file which contains Base64 encoded data of DLL ...
-
web:www.mycert.org.my
The primary objective of StrelaStealer is to pilfer email login credentials from popular email clients and transmit them back to the Command and Control (C2) server specified in the malware configuration. Figure 10: StrelaStealer string as well as C2 server name . The StrelaStealer threat actor has introduced several significant modifications.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.