Strela Stealer Targets Europe Stealthily Via WebDav
Tags
cmtmf-attack-pattern: Application Layer Protocol Command And Scripting Interpreter
country: Germany Spain
maec-delivery-vectors: Watering Hole
attack-pattern: Data Application Layer Protocol - T1437 Command And Scripting Interpreter - T1623 Credentials - T1589.001 Email Account - T1087.003 File And Directory Discovery - T1420 Javascript - T1059.007 Malware - T1587.001 Malware - T1588.001 System Information Discovery - T1426 Multi-Factor Authentication - T1556.006 Phishing - T1660 Phishing - T1566 Powershell - T1059.001 Rundll32 - T1218.011 Server - T1583.004 Server - T1584.004 Software - T1592.002 Standard Application Layer Protocol - T1071 Command-Line Interface - T1059 Credential Dumping - T1003 Exfiltration Over Command And Control Channel - T1041 Exploitation For Client Execution - T1203 File And Directory Discovery - T1083 Powershell - T1086 Rundll32 - T1085 Scripting - T1064 System Information Discovery - T1082 User Execution - T1204 Scripting User Execution
Show in Graph
Common Information
Type Value
UUID 828b7d46-7cd0-43b3-9ce0-2a195114bcb0
Fingerprint a89f456934ae9e88
Analysis status DONE
Considered CTI value 2
Text language
Published Oct. 30, 2024, 8:58 a.m.
Added to db Oct. 30, 2024, 2:07 p.m.
Last updated Nov. 17, 2024, 6:56 p.m.
Headline Strela Stealer targets Central and Southwestern Europe through Stealthy Execution via WebDAV
Title Strela Stealer Targets Europe Stealthily Via WebDav
Detected Hints/Tags/Attributes 93/4/120
Source URLs
Redirection Url
Details Source https://cyble.com/blog/strela-stealer-targets-europe-stealthily-via-webdav/
URL Provider
Details Provider Source level domain
Details cyble.com cyble.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 98 ✔ Cyble https://cyble.com/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 2 
vaultdocker.com
Details Domain 2 
cloudslimit.com
Details Domain 2 
dailywebstats.com
Details Domain 2 
endpointexperiment.com
Details Domain 2 
apitestlabs.com
Details Domain 224 
unit42.paloaltonetworks.com
Details File 1018 
rundll32.exe
Details File 1 
rg_175_133572_7063403.zip
Details File 1 
1819737872954318698.js
Details File 1 
96492217114973.dll
Details File 24 
server.php
Details File 41 
key4.db
Details File 8 
login.json
Details File 64 
logins.json
Details md5 13 
9375CFF0413111d3B88A00104B2A6676
Details sha256 2 
dcd7dd2aaef3e87b467ce4e4682a63d2d01da20e31fada494435ae8a921c09ae
Details sha256 2 
75d996a0a5262bff134d7a752efd1fb6325bc2ce347b084967e06725008180f9
Details sha256 2 
c5279ff9c215afbd5c54793c6fc36c80d2cefb0342a1471581b15e43bd4a9b08
Details sha256 2 
be76ab2054ef174331abfef53825254ac26bfc9657dca9c3767a5e5daf7bec1e
Details sha256 2 
4e38abd0fef9a4b3f4cbc674601bc10766d4db588cb83d3e5fb50ec573c372cd
Details sha256 2 
08007bc4c3711990eddd7cb342d176f470298027d923589206e4c9212cc95ba3
Details sha256 2 
12cd832efcd3e3a6938ca5d445f572731b64866afc0129219d8110030aa22242
Details sha256 2 
150f490ae97098342e192a6722872e86d468cbd2fd8b3d6c46f4601acdea85d1
Details sha256 2 
154daf225df559d44d066027a5179aa68ebd9ce046787faa84bd3c230ad3fd08
Details sha256 2 
16ae254deaa02b0acf5beda73cb178eb5c50e50b8d1752841ae8148b28354585
Details sha256 2 
1a60dd873e71c926ede3bc395e45e10062f063a374f05e7ff6721b6e35706ec5
Details sha256 2 
1f3b7fb2ec7e3f292a9d5fab2e263c777c4273af872673d324d580387a5f3236
Details sha256 2 
22d34569742fc22c109f65a2edc8ef264c44f61e20014ac27160931acfba296c
Details sha256 2 
294c66460c3b0da83a3ed894bd1fb8a7fc5fed2b8fb3f6adb555d4b558371f00
Details sha256 2 
2c447b38bc71b6b68234e3f7ea389807a9d61597aab5a11cc60133ee01fb7b79
Details sha256 2 
3078f89fa189af1fc8d9b76ab03e2ae34de080072057d5630f8d829c18e0b29b
Details sha256 2 
32b8f94f5f7f359a3ef758a8de8ed554c7e5dec2b75f9a65461167eaa874cd00
Details sha256 2 
34e9df65677f7e89fd3514103d9a75f7fb526485f1c8fa3bf82fe8896991683a
Details sha256 2 
34fdf466af7288f0b458daaca9eb76be88e182ae1b2eadb3281371c2d6726bc3
Details sha256 2 
36a0751216fc7f90559abb10dcec2c1153e70c9d4da4d06a0a206ec2e726b92f
Details sha256 2 
37984a476fdeda094cdb82957a5aa0d2835527c4f403775d5e0182c64cb1a7fb
Details sha256 2 
3c09514e197004d822fd26798372cd7dc30ddcc7fe5585a8a13475319f57e7de
Details sha256 2 
3fe89e89556c0210bfb5094a524b1f81c87cde6b6bb2320abbe61d68ac6c4a4b
Details sha256 2 
404341b290e56b21c74d5768a98580813f5e81a5ef2e97e1af7aec6cb2a719b0
Details sha256 2 
4781f4c8a8a43b559d1c1452e0e967cd23f7fd3d41a1065e5a3ec3366e3bf496
Details sha256 2 
4a2317a78749539a8bf0d1e134bd68f64a5e956dee9a12157028969949bb29c4
Details sha256 2 
4eaf2d0023d9531ee9e0d3958014260d95b817af5e74b9c6819f371a1a5af753
Details sha256 2 
50c9bd0f5deca0b2edbc4128aa7895ec0268a246e536110efe81e3a3da696b0c
Details sha256 2 
540492ee7e2e3a0036bc34ff47519a17ad6a8300319b1ff9a1d1a210333cb46d
Details sha256 2 
58b0ae24a7f325b8c3acd001b4bdff35fc7e440a0bb910750e019a2657de0822
Details sha256 2 
59894ed00aaa9f8ab743ea09a1c7add38b7bf378b073aea978fb1703ea9aacdd
Details sha256 2 
59c8dcd99af398b149bfd80b921e1b06f97e8cc6908d806b174341efb899d647
Details sha256 2 
5a3633e0aad62b5ca063e3ffb15a2bbcdf7138f82113299b53f8194525cb32a3
Details sha256 2 
5b296616d0cd44147e84e638dffed68d07b305bcee60601147bf41cb01e8c038
Details sha256 2 
5c3a86bd9fb12cad7a98041d1ff35ac739b41a9e43abc525c4e96d61be6f9565
Details sha256 2 
6044ea92d233b14cc6422e1cea8ee7ea8e241812f3e780f57f096101e5917f8a
Details sha256 2 
662a2a870928dc42d9cd04dbbb7a948300c98496bf4f68aa7ce1320d93da3180
Details sha256 2 
666060f975e34e610bea2a3e2a6c8bad58506bee6acfbaefd2c02e563736351f
Details sha256 2 
67e95381a8d220063ea1a44e75bc9c9c2e0d973fb991c0ce92a798a1bfe23c1d
Details sha256 2 
680ea9c726dbfb5b8486ef5b5babb63704f32b4e3e949053b13a344440fe5149
Details sha256 2 
68ffebea33905d680c382b4df481c564817044cf41345f41166cfaca106abfee
Details sha256 2 
6cb21cba9555eec2a173719188ffa609f3f99b6f615ada694db3e2de7fa4d9fe
Details sha256 2 
70f500e1941ce7f0ae0d4c12c44f3e265c701c1169193a55e5f842c093f303cc
Details sha256 2 
72c9297608f3ccb059aec33126178e40bd343c3c24b14a8a31a7742757a08a00
Details sha256 2 
760c12ae673ae8902dfa096c17bbce7fc3e20eec069b7cc00d6bf1dd4a28757b
Details sha256 2 
76972fe36498d115bbcb742d842698fea1ebc062d0f79426dfbcaf4ad8bec0bd
Details sha256 2 
78c315657a6dd2d6ca01388aa3575344b689cbd18c172d83fe94399156b8010b
Details sha256 2 
7fcf23ad9d241ccd8f46a9a65bdd99741bade2bf323599f5639ebf160d35aa1e
Details sha256 2 
8502cf3b180e3ee6e526b5b33e17647d7234773c278d9009a6ae58a01fd96b97
Details sha256 2 
8661d72b99ae335b6c0c74e2d2f156f8611666fe7f118ae251e224c8602f72f2
Details sha256 2 
8ba18307df322c7c930dc19ff5f3a36b6a9040cc0dd05e65c1a434887a407b70
Details sha256 2 
9082620184a4fe05ed92a0e88caea02cfec14d4c6494dc55269d8afade95d352
Details sha256 2 
9255e44bcf40afa3c3fbd19f13a1d277c3bd7bd457866e904b220779fadce886
Details sha256 2 
93fc8a04b28af9feb86c348c9b3a7d8422729697832e6895f8738b663da32905
Details sha256 2 
9a9303997fefb2de0a66db9652d53bce7d17b9a1e8e738ee91801a29f72621d6
Details sha256 2 
9aefb3b5e3a0727c6d96b103c432acb57c42294373bbd8d984a8aeb94659cd43
Details sha256 2 
9eb4a88bc7ba156af849fcd956744c65677372db5e5cb09115df8ec900928cbb
Details sha256 2 
9fc8d64d8204045764d0990647d42cb386c98501199553d043c277133549193a
Details sha256 2 
a09688c0ce051235e92bb938090eebedea57c706158e0b665edce17d8dbe7543
Details sha256 2 
a0def4009d3d6444b05f8d4071a65fbba6b6b36176104fc1fbb04affd0282969
Details sha256 2 
a21f6c960cb3a702a9cf1da645301688b98763a8d1a4269a6b010616477e742f
Details sha256 2 
a76fc70044c88c9313da07e3afa039640373c639ac16ae85ddef201fa5995ce3
Details sha256 2 
a77cd7dcea434bea2ce6dbc1af32668007c0fc5168a325c0c9df8f976d47ae0c
Details sha256 2 
b0f2cff2784b1779a9688a3cd43436d272683554b356d2a6f75903e40ce680ed
Details sha256 2 
b2efbb7368a89a746f5f1aea8e3df16cb017b4f79e0a6c3c1aaf51a7437cdd1b
Details sha256 2 
b5f9dff76d3cdf16ad8c95e699a4dd347e2bf987d7b9a4601b4bb6b7505a560f
Details sha256 2 
c1503c63332d723bc67acdc8de2fbaffb92b11de8174030eaf863d7ed152f947
Details sha256 2 
c55f10a2633aa6c7f5e246cee23ed04e73896f88a042c070a6c66698dc8b1f3e
Details sha256 2 
ca3a8107b0c1ecf1a9f258e5b155a652e81710a2fa910bfd5ed31305a10ed06f
Details sha256 2 
ca6446b428305c1845b87a4562c4ef24d99e5929a2a65101689ca473b0bbec43
Details sha256 2 
d3b78c9fdf7df019c14a21c18f4ca27c4210f31191ba5f35de358373b4077d43
Details sha256 2 
d40dbeaf32abed1610e11408953ddddad985cea279b86c31a27b841519112bfb
Details sha256 2 
e2fa1484fa6cccfdae5838e59f4516017c3cd15e4872db0e459c43c8c8076882
Details sha256 2 
ea090dccb35324c998ac5c2e3e499ed4c3812372cd6936777a9b4d10f8329c65
Details sha256 2 
ee5cee0d57239e192cde8a52398172b515148969e4f6fc4bcf89de24aedafd4b
Details sha256 2 
f2708c2b771610ecda87d43c409a943fc4df6cdb090737ea47017f5ea4fc6a85
Details sha256 2 
f68522b21d226a9d7ab91105e4412ea3ad836801e090e1e6dce766def233c607
Details sha256 2 
f85dbbb00236db3abcc3383f2708fa4f53f5a464a62c4338391f513f49ea8b76
Details sha256 2 
fc9617a69ee597606fbc68a5280819e48c9679b1d44d09f86cb4b62b68835209
Details sha256 2 
fd407ac4d456c2196b128587347d85856989faec188334a8fbc4469f4b4e6ef2
Details sha256 2 
fed183856e7f09bb9f73d8c9d57bd3573ec846da1a49dc1eeb295c845007f5a2
Details sha256 2 
ffdf20ae5a3124a69711eb46b11b01bed6cffb66aef711732f96ddb4546cb635
Details sha256 2 
ffe0ff011712afeb8ebc70e09bb455cc6fdd36c8d3b31004d25dc1cd8cc74b8f
Details sha256 2 
04f2cd6ddf9faef579d303c5efd2fc65b9997e05c3f75ea9b0cfc474f5e9019a
Details sha256 2 
13d96ed827887f6c31d907a5ee29441e2afd95be683e51e874cf5ad8207c1a98
Details sha256 2 
1970d38e7fa45a46e792372a19d890541c87d1007ddedd53858b6df6728d72ff
Details sha256 2 
dbd301f710d45acdd639cda5cd47a5453b9abb8a361ed250bfc47de70318fec6
Details sha256 2 
13531bd403e5f8f607bf16144c38ffd94004eafa8e6a098628b915de07ba432b
Details sha256 2 
080caffde331496a46e8cb35acd107ed113046b46310747a2dd15a62efab23b5
Details sha256 2 
bd26724bdc8c5d9cb65d361231048725fbc31072d4c457c23531bc4333460011
Details sha256 2 
77836c0b18bbfef70fd04ba674ea045bf109851efe76ae9bcc55c2dcd08cc3c5
Details sha256 3 
03853c56bcfdf87d71ba4e17c4f6b55f989edb29fc1db2c82de3d50be99d7311
Details sha256 2 
cd39bec789b79d9ea6a642ab2ddc93121f5596de21e3b13c335ceaddb83f2083
Details sha256 2 
b9ae263904d3a5fb8471a0f8ab95fcbb224f632e6185e3a110e8d5aed9785420
Details IPv4 2 
94.159.113.48
Details MITRE ATT&CK Techniques 409 
T1566
Details MITRE ATT&CK Techniques 245 
T1203
Details MITRE ATT&CK Techniques 695 
T1059
Details MITRE ATT&CK Techniques 289 
T1003
Details MITRE ATT&CK Techniques 1006 
T1082
Details MITRE ATT&CK Techniques 585 
T1083
Details MITRE ATT&CK Techniques 444 
T1071
Details MITRE ATT&CK Techniques 422 
T1041
Details Url 252 
https://medium.com
Details Url 1 
https://unit42.paloaltonetworks.com/strelastealer-campaign