LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1183: StrelaStealer

StrelaStealer is an information stealer malware variant first identified in November 2022 and active through late 2024. StrelaStealer focuses on the automated identification, collection, and exfiltration of email credentials from email clients such as Outlook and Thunderbird.[1][2][3][4]

EnterpriseS1183MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

StrelaStealer matters because its stated purpose is to find, collect, and exfiltrate email credentials from Windows email clients such as Outlook and Thunderbird. For leaders, the business issue is not just malware cleanup: stolen mailbox credentials can affect communications integrity, identity response, audit evidence, and the organization’s ability to trust email during an incident.

Executive priority

Treat this as an identity-and-communications resilience scenario. Ask whether the organization can quickly determine which Windows endpoints use local email clients, whether email credential theft would be visible, and whether SOC and IR teams can connect endpoint execution, obfuscated payloads, and outbound exfiltration activity into one incident narrative. Because ATT&CK provides no official detection text for this software, coverage should be proven through local telemetry validation rather than assumed from tool ownership.

Technical view

ATT&CK lists StrelaStealer as Windows malware focused on automated identification, collection, and exfiltration of email credentials. Related behaviors include user-driven malicious file execution, PowerShell/cmd/JavaScript execution, rundll32 proxy execution, system information discovery, automated collection and exfiltration, web-protocol C2, encoded or obfuscated C2 traffic, packed/compressed/encoded files, masquerading, and execution guardrails. SOC teams should validate detection chains that join suspicious script or rundll32 activity, unusual access to Outlook or Thunderbird-related credential material, obfuscated or masqueraded artifacts, and outbound web traffic consistent with C2 or exfiltration.

Likely telemetry

  • Windows endpoint process creation for PowerShell, cmd, JavaScript/JScript engines, and rundll32.exe
  • File creation, file metadata, and content-scanning evidence for packed, compressed, encoded, renamed, or masqueraded payloads
  • Endpoint events showing access to Outlook and Thunderbird credential-related data or profile locations
  • Network telemetry for outbound web-protocol communications, C2-like sessions, encoded data, and automated exfiltration patterns
  • Script logging and command-line arguments where available

Detection direction

  • Do not rely on a single malware name or signature; the relationships emphasize obfuscation, packing, compression, encoding, masquerading, and renamed utilities.
  • Tune detections around behavior chains: user-opened file leading to script or rundll32 execution, followed by email-client credential access and outbound web traffic.
  • Baseline legitimate rundll32, PowerShell, cmd, and JavaScript activity to reduce false positives while preserving visibility into unusual parent-child process relationships and command lines.
  • Inspect outbound web traffic for encoded or obfuscated content, but account for the fact that normal web traffic can look noisy without endpoint correlation.
  • Confirm whether endpoint tooling records file type mismatches, suspicious names or locations, and packed or compressed artifacts; these are common blind spots for static-only controls.

Mitigation priorities

  • Prioritize protection and response procedures for email-client credential theft, including rapid credential invalidation and mailbox access review where applicable.
  • Harden and monitor Windows script execution paths and rundll32 usage, focusing on abuse rather than blocking legitimate administration blindly.
  • Reduce user-executed malicious file risk through attachment/file handling controls and user-facing safeguards appropriate to the environment.
  • Strengthen outbound web traffic monitoring and egress controls so automated exfiltration over C2 or web protocols is easier to identify and contain.
  • Ensure incident response playbooks connect endpoint containment with identity, mailbox, and communications-impact decisions.
Additional notes and limits

The most decision-relevant point is the combination of Windows endpoint execution, credential-focused collection from local email clients, and automated exfiltration. Glexia would treat this as a SOC plus identity response validation case: can teams prove what ran, what mailbox credentials may have been accessed, and what left the network?

The supplied ATT&CK object has no official detection text, no aliases, and no top-level tactics specified. Several behavior details come from relationships to ATT&CK techniques, not from a full procedure description. Local endpoint, email-client, identity, and network evidence is required before assessing exposure or control effectiveness.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

StrelaStealer

StrelaStealer is an information stealer malware variant first identified in November 2022 and active through late 2024. StrelaStealer focuses on the automated identification, collection, and exfiltration of email credentials from email clients such as Outlook and Thunderbird.[1][2][3][4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

34 rows
DomainIDNameRelationship / procedure
EnterpriseT1001Data Obfuscation

StrelaStealer encrypts the payload of HTTP POST communications using the same XOR key used for the malware's DLL payload.[1]

EnterpriseT1041Exfiltration Over C2 Channel

StrelaStealer exfiltrates collected email credentials via HTTP POST to command and control servers.[1][2][3][4]

EnterpriseT1027.016Junk Code InsertionSub-technique

StrelaStealer variants have included excessive mathematical functions padding the binary and slowing execution for anti-analysis and sandbox evasion purposes.[3]

EnterpriseT1071.001Web ProtocolsSub-technique

StrelaStealer communicates externally via HTTP POST with encrypted content.[1][3][4]

EnterpriseT1622Debugger Evasion

StrelaStealer variants include functionality to identify and evade debuggers.[3]

EnterpriseT1027Obfuscated Files or Information

StrelaStealer has been distributed in ISO archives.[1] StrelaStealer has been delivered in encrypted, password-protected ZIP archives.[4]

EnterpriseT1553.002Code SigningSub-technique

StrelaStealer variants have used valid code signing certificates.[4]

EnterpriseT1480Execution Guardrails

StrelaStealer variants only execute if the keyboard layout or language matches a set list of variables.[3][4]

EnterpriseT1036.003Rename Legitimate UtilitiesSub-technique

StrelaStealer has used a renamed, legitimate `msinfo32.exe` executable to sideload the StrelaStealer payload during initial installation.[1]

EnterpriseT1204.002Malicious FileSub-technique

StrelaStealer relies on user execution of a malicious file for installation.[1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

StrelaStealer uses XOR-encoded strings to obfuscate items.[1]

EnterpriseT1059.007JavaScriptSub-technique

StrelaStealer has been distributed as a malicious JavaScript object.[2][3][4]

EnterpriseT1218.011Rundll32Sub-technique

StrelaStealer DLL payloads have been executed via `rundll32.exe`.[2][4]

EnterpriseT1518Software Discovery

StrelaStealer variants use COM objects to enumerate installed applications from the "AppsFolder" on victim machines.[4]

EnterpriseT1027.002Software PackingSub-technique

StrelaStealer variants have used packers to obfuscate payloads and make analysis more difficult.[2]

EnterpriseT1059.001PowerShellSub-technique

StrelaStealer variants have used PowerShell scripts to download or drop payloads, including obfuscated variants to connect to a WebDAV server to download and executed an encrypted DLL for installation.[4]

EnterpriseT1059.003Windows Command ShellSub-technique

StrelaStealer has included BAT files in some instances for installation.[3][4]

EnterpriseT1497Virtualization/Sandbox Evasion

StrelaStealer payloads have used control flow obfuscation techniques such as excessively long code blocks of mathematical instructions to defeat sandboxing and related analysis methods.[2][3]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

StrelaStealer has been distributed as a spearphishing attachment.[1]

EnterpriseT1027.015CompressionSub-technique

StrelaStealer has been delivered via JScript files in a ZIP archive.[2][3]

EnterpriseT1552.002Credentials in RegistrySub-technique

StrelaStealer enumerates the registry key `HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\` to identify the values for "IMAP User," "IMAP Server," and "IMAP Password" associated with the Outlook email application.[1][3][4]

EnterpriseT1036Masquerading

StrelaStealer PE executable payloads have used uncommon but legitimate extensions such as `.com` instead of `.exe`.[4]

EnterpriseT1132.001Standard EncodingSub-technique

StrelaStealer utilizes a hard-coded XOR key to encrypt the content of HTTP POST requests to command and control infrastructure.[4]

EnterpriseT1574.001DLLSub-technique

StrelaStealer has sideloaded a DLL payload using a renamed, legitimate `msinfo32.exe` executable.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

StrelaStealer payloads have tailored filenames to include names identical to the name of the targeted organization or company.[4]

EnterpriseT1614.001System Language DiscoverySub-technique

StrelaStealer variants check system language settings via keyboard layout or similar mechanisms.[3][4]

EnterpriseT1140Deobfuscate/Decode Files or Information

StrelaStealer payloads have included strings encrypted via XOR.[1] StrelaStealer JavaScript payloads utilize Base64-encoded payloads that are decoded via certutil to create a malicious DLL file.[2][3]

EnterpriseT1105Ingress Tool Transfer

StrelaStealer installers have used obfuscated PowerShell scripts to retrieve follow-on payloads from WebDAV servers.[4]

EnterpriseT1480.002Mutual ExclusionSub-technique

StrelaStealer variants include the use of mutex values based on the victim system name to prevent reinfection.[3]

EnterpriseT1082System Information Discovery

StrelaStealer variants collect victim system information for exfiltration.[4]

EnterpriseT1552.001Credentials In FilesSub-technique

StrelaStealer searches for and if found collects the contents of files such as `logins.json` and `key4.db` in the `$APPDATA%\Thunderbird\Profiles\` directory, associated with the Thunderbird email application.[1][3]

EnterpriseT1119Automated Collection

StrelaStealer attempts to identify and collect mail login data from Thunderbird and Outlook following execution.[1][2][3][4]

EnterpriseT1036.008Masquerade File TypeSub-technique

StrelaStealer has been distributed as a DLL/HTML polyglot file.[1][4]

EnterpriseT1020Automated Exfiltration

StrelaStealer automatically sends gathered email credentials following collection to command and control servers via HTTP POST.[1][4]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1001: Data ObfuscationEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1027.016: Junk Code InsertionEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1622: Debugger EvasionEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1553.002: Code SigningEnterpriseuses · TechniqueT1480: Execution GuardrailsEnterpriseuses · TechniqueT1036.003: Rename Legitimate UtilitiesEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1059.007: JavaScriptEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1518: Software DiscoveryEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1497: Virtualization/Sandbox EvasionEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1027.015: CompressionEnterpriseuses · TechniqueT1552.002: Credentials in RegistryEnterpriseuses · TechniqueT1036: MasqueradingEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1574.001: DLLEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
45e86b27412cd0b3...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle45e86b27412c…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  2. [2]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  3. [3]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  4. [4]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  5. [5]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  6. [6]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  7. [7]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  8. [8]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  9. [9]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  10. [10]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  11. [11]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  12. [12]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  13. [13]
    mitre-attackS1183
    Open source URL
  14. [14]
    mitre-attackS1183
    Open source URL
  15. [15]
    mitre-attackS1183
    Open source URL
  16. [16]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  17. [17]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  18. [18]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  19. [19]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  20. [20]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  21. [21]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  22. [22]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  23. [23]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  24. [24]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  25. [25]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  26. [26]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  27. [27]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  28. [28]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  29. [29]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  30. [30]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  31. [31]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  32. [32]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  33. [33]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  34. [34]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  35. [35]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  36. [36]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  37. [37]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  38. [38]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  39. [39]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  40. [40]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  41. [41]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  42. [42]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  43. [43]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  44. [44]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  45. [45]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  46. [46]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  47. [47]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  48. [48]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  49. [49]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  50. [50]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  51. [51]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  52. [52]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  53. [53]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  54. [54]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  55. [55]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  56. [56]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  57. [57]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  58. [58]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  59. [59]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  60. [60]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  61. [61]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  62. [62]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  63. [63]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  64. [64]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  65. [65]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  66. [66]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  67. [67]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  68. [68]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  69. [69]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  70. [70]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  71. [71]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  72. [72]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  73. [73]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  74. [74]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  75. [75]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  76. [76]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  77. [77]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  78. [78]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  79. [79]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  80. [80]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  81. [81]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  82. [82]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  83. [83]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  84. [84]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  85. [85]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  86. [86]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  87. [87]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  88. [88]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  89. [89]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  90. [90]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  91. [91]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  92. [92]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  93. [93]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  94. [94]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  95. [95]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  96. [96]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  97. [97]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  98. [98]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  99. [99]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  100. [100]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  101. [101]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  102. [102]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  103. [103]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  104. [104]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  105. [105]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  106. [106]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  107. [107]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  108. [108]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  109. [109]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  110. [110]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  111. [111]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  112. [112]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  113. [113]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  114. [114]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  115. [115]
    PaloAlto StrelaStealer 2024

    Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.

    Open source URL
  116. [116]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  117. [117]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
  118. [118]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  119. [119]
    IBM StrelaStealer 2024

    Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use