New StrelaStealer information-stealing malware steals mail credentials

guest · Nov 9, 2022

New StrelaStealer malware steals your Outlook, Thunderbird accounts
By Bill Toulas @billtoulas - November 9, 2022

A new information-stealing malware named 'StrelaStealer' is actively stealing email account credentials from Outlook and Thunderbird, two widely used email clients.

This behavior deviates from most info-stealers, which attempt to steal data from various data sources, including browsers, cryptocurrency wallet apps, cloud gaming apps, the clipboard, etc.
Click to expand...

The previously unknown malware was discovered by analysts at DCSO CyTec, who report that they first saw it in the wild in early November 2022, targeting Spanish-speaking users.
Polyglot file infection
StrelaStealer arrives on the victim's system via email attachments, currently ISO files with varying content.
In one example, the ISO contains an executable ('msinfo32.exe') that sideloads the bundled malware via DLL order hijacking.

In a more interesting case seen by the analysts, the ISO contains an LNK file ('Factura.lnk') and an HTML file ('x.html'). The x.html file is of particular interest because it is a polyglot file, which is a file that can be treated as different file formats depending on the application that opens it.
Click to expand...

StrelaStealer details
Upon execution, StrelaStealer searches the '%APPDATA%\Thunderbird\Profiles\' directory for 'logins.json' (account and password) and 'key4.db' (password database) and exfiltrates their contents to the C2 server.
For Outlook, StrelaStealer reads the Windows Registry to retrieve the software's key and then locates the 'IMAP User', 'IMAP Server', and 'IMAP Password' values.

The IMAP Password contains the user password in encrypted form, so the malware uses the Windows CryptUnprotectData function to decrypt it before it's exfiltrated to the C2 along with the server and user details.
Click to expand...

DCSO CyTec: #ShortAndMalicious: StrelaStealer aims for mail credentials

In our newest category #ShortAndMalicious DCSO CyTec aims to briefly highlight new and interesting samples we come across in our daily hunt for malware.

For the first entry in the series, we take a brief look at an undocumented custom malware we have been analysing under the moniker “StrelaStealer” (“Стрела” == arrow) which appears to be purpose-built to steal mail login data.
Click to expand...

Log in or Sign up

New StrelaStealer information-stealing malware steals mail credentials

guest Guest

Log in or Sign up

New StrelaStealer information-stealing malware steals mail credentials

guest Guest

Useful Searches