Strela Stealer
Strela Stealer is an information-stealing malware family focused on harvesting email client credentials, specifically from Microsoft Outlook and Mozilla Thunderbird. Reported theft includes Thunderbird credentials from %APPDATA%\Thunderbird\Profiles\logins.json and key4.db, and Outlook IMAP credentials from registry locations, with password decryption via CryptUnprotectData(). IBM X-Force reported exfiltration over HTTP POST to a hardcoded C2 endpoint at http://94.159.113[.]48/server.php, with repeated transmission attempts until a stop string such as "KH," "ANTIROK," or "CHOLLIMA" is received.
The malware is associated with the financially motivated threat actor Hive0145, which IBM assessed may be the sole operator and likely functions as an initial access broker. Campaigns have targeted victims across Europe since at least late 2022, with reporting specifically naming Spain, Germany, Ukraine, Austria, Liechtenstein, Luxembourg, and Switzerland. Trustwave SpiderLabs and IBM both described targeting of Outlook and Thunderbird users, and Proton66-hosted infrastructure was reported as being used to distribute Strela Stealer in early 2025.
Observed delivery is primarily phishing-based. Hive0145 used invoice and receipt lures, including authentic stolen invoice emails whose attachments were replaced with malicious payloads while preserving the original email content and filename pattern. Infection chains included archives containing heavily obfuscated JavaScript downloaders that retrieved and executed crypted Strela Stealer DLLs, often via WebDAV and rundll32.exe. Earlier campaigns used polyglot files, encrypted ZIP archives with per-email passwords, uncommon executable extensions such as .com and .pif, valid code-signing certificates, and a custom crypter/loader referred to as Stellar Crypter or Stellar Loader, which decrypts and executes the payload in memory. Recent variants reportedly added host profiling via systeminfo output and installed-application enumeration, along with expanded language and locale checks.
Strela Stealer has also been distributed through infrastructure operated by Detour Dog, which Infoblox described as a service provider or partner rather than the malware operator. Detour Dog used compromised WordPress sites, DNS TXT-record-based command and control, and a first-stage backdoor/reverse shell called StarFish to facilitate delivery. Infoblox reported Base64-encoded TXT responses containing the word "down" to trigger remote file execution behavior on infected sites, which then retrieved content from verified Strela Stealer C2 infrastructure. Spam delivery in these campaigns was linked to REM Proxy and Tofsee botnets, while Detour Dog hosted much of the first-stage infrastructure.
High-confidence infrastructure and indicators mentioned in the content include the Strela Stealer C2 endpoint 94.159.113[.]48/server.php, WebDAV delivery from 94.159.113.48:8888, and Detour Dog sinkholed C2 domains webdmonitor[.]io and aeroarrows[.]io associated with Strela-related delivery operations.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A threat actor named Detour Dog has been outed as powering campaigns distributing an information stealer known as Strela Stealer.
A threat actor named Detour Dog has been outed as powering campaigns distributing an information stealer known as Strela Stealer.
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
"Cybersecurity Training Programs Don’t Prevent Employees from Falling for Phishing Scams" ... "After sending 10 different types of phishing emails..."; "...servers... resolve multiple domains used for phishing purpose."; "...use of phishing and fake app stores..."; "...email attachment."
Credential Access
1 technique
Credential Access
IOCs tracked for this family
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Infostealer malware distributed via DNS-based attacks, capable of stealing credentials and sensitive information from infected hosts. Delivered through compromised websites using DNS TXT records as covert C2 and payload delivery channels.
Information-stealing malware delivered via compromised WordPress sites, used to exfiltrate sensitive data from infected systems.
Stealer malware referenced as being used in campaigns powered by 'Detour Dog' DNS malware.
Information-stealing malware referenced in connection with Detour Dog’s DNS-based staging/distribution technique.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.