StrelaStealer
Software · ATTACK:enterprise:S1183
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1183",
"title": "StrelaStealer",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1183",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--951313b3-6064-4ce0-b4b6-a153c3973da7",
"external_id": "S1183",
"domain": "enterprise",
"created": "2024-12-31T16:12:44.473Z",
"modified": "2025-03-10T18:57:36.697Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "PaloAlto StrelaStealer 2024",
"url": "https://unit42.paloaltonetworks.com/strelastealer-campaign/"
},
{
"source_name": "DCSO StrelaStealer 2022",
"url": "https://medium.com/@DCSO_CyTec/shortandmalicious-strelastealer-aims-for-mail-credentials-a4c3e78c8abc"
},
{
"source_name": "Fortgale StrelaStealer 2023",
"url": "https://fortgale.com/blog/malware-analysis/strelastealer-malware-analysis-2/"
},
{
"source_name": "IBM StrelaStealer 2024",
"url": "https://securityintelligence.com/x-force/strela-stealer-todays-invoice-tomorrows-phish/"
}
]
}Explicit source assertions (34)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09388627-d275-4b74-bcd4-d8643d3e0482
DCSO StrelaStealer 2022ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e08fbc4-2fe5-4761-8f70-3dc74af48a57
PaloAlto StrelaStealer 2024 · DCSO StrelaStealer 2022 · Fortgale StrelaStealer 2023 · IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1027.016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10ce7f0b-4e2d-4e56-9ae1-646f5b3ceba5
Fortgale StrelaStealer 2023ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1da4f275-e4a1-4a0c-b5a6-4b0be08aa45d
DCSO StrelaStealer 2022 · Fortgale StrelaStealer 2023 · IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2157f938-0fce-462e-b0aa-9749414d4972
Fortgale StrelaStealer 2023ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26402760-e6cb-47b7-aabc-8271549e5f22
DCSO StrelaStealer 2022 · IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b2f2100-16ea-439b-ad64-fe1e8a9c23df
IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38640ec4-060f-47ea-8ea5-58e42f5e8341
Fortgale StrelaStealer 2023 · IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3971fa3e-6ed3-4bc0-84d6-115431ac8d96
DCSO StrelaStealer 2022ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4127f483-dbd5-4189-84a8-209f04259443
DCSO StrelaStealer 2022ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41a691f8-4d5c-4678-9305-519dbb70ba46
DCSO StrelaStealer 2022ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48f75458-3c14-4ffe-9950-97d6bff16822
PaloAlto StrelaStealer 2024 · Fortgale StrelaStealer 2023 · IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--502058a1-d9ea-42ec-af45-3b2bf152092d
PaloAlto StrelaStealer 2024 · IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5166f101-8d87-4967-bc3c-5f6ee97b863c
IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--531ba99f-18d6-4ecd-a8ec-6d40550bf4af
PaloAlto StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58a77e0d-8848-47a8-b743-e69aced6b50b
IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d82c047-f175-4efe-8380-099da617bf01
Fortgale StrelaStealer 2023 · IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e2f668c-dfbd-482c-a5a7-c8ccfd378002
PaloAlto StrelaStealer 2024 · Fortgale StrelaStealer 2023ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72edd078-766e-4ae1-80de-f2c5248fb9bf
DCSO StrelaStealer 2022ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1027.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7522bc84-384e-497f-8898-196283ba5ec1
PaloAlto StrelaStealer 2024 · Fortgale StrelaStealer 2023ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78c485fa-43f7-46b5-8f19-160fdec2f090
DCSO StrelaStealer 2022 · Fortgale StrelaStealer 2023 · IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c0d0a39-3a59-450b-8101-3e79792cd37f
IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8aaf06cc-1245-47d2-b270-b7854eec5b64
IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94ec8332-4115-4c83-900e-a72598a8680b
DCSO StrelaStealer 2022ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c6c1bab-3c23-4f0f-9e20-1eac082f6e50
IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bcf269ba-f79e-4bdf-bbcf-a8313dad7edd
Fortgale StrelaStealer 2023 · IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c948844f-25f3-4fbd-b949-f6c61a459aeb
PaloAlto StrelaStealer 2024 · DCSO StrelaStealer 2022 · Fortgale StrelaStealer 2023ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d40cf993-60c2-4b5f-8af8-fb8975b43ebf
IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db52b791-ad42-45e5-b3be-5386c0d819f2
Fortgale StrelaStealer 2023ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de9ac4ba-9e06-4704-9549-b3c59882bdb2
IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1552.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--deddda4d-6ce3-4531-aaea-b7b049597a22
DCSO StrelaStealer 2022 · Fortgale StrelaStealer 2023ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ef704a2d-c73c-4cf1-947d-f70efbee6894
PaloAlto StrelaStealer 2024 · DCSO StrelaStealer 2022 · Fortgale StrelaStealer 2023 · IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1036.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6a93744-aca6-47ff-84f3-e03dd417c0d4
DCSO StrelaStealer 2022 · IBM StrelaStealer 2024ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7539748-0911-4a98-a98f-f512d1424d85
DCSO StrelaStealer 2022 · IBM StrelaStealer 2024