Procedure examples

StrelaStealer encrypts the payload of HTTP POST communications using the same XOR key used for the malware's DLL payload.

StrelaStealer automatically sends gathered email credentials following collection to command and control servers via HTTP POST.

StrelaStealer has been distributed in ISO archives. StrelaStealer has been delivered in encrypted, password-protected ZIP archives.

StrelaStealer variants have used packers to obfuscate payloads and make analysis more difficult.

StrelaStealer uses XOR-encoded strings to obfuscate items.

StrelaStealer has been delivered via JScript files in a ZIP archive.

StrelaStealer variants have included excessive mathematical functions padding the binary and slowing execution for anti-analysis and sandbox evasion purposes.

StrelaStealer PE executable payloads have used uncommon but legitimate extensions such as `.com` instead of `.exe`.

StrelaStealer has used a renamed, legitimate `msinfo32.exe` executable to sideload the StrelaStealer payload during initial installation.

StrelaStealer payloads have tailored filenames to include names identical to the name of the targeted organization or company.

StrelaStealer has been distributed as a DLL/HTML polyglot file.

StrelaStealer exfiltrates collected email credentials via HTTP POST to command and control servers.

StrelaStealer variants have used PowerShell scripts to download or drop payloads, including obfuscated variants to connect to a WebDAV server to download and executed an encrypted DLL for installation.

StrelaStealer has included BAT files in some instances for installation.

StrelaStealer has been distributed as a malicious JavaScript object.

StrelaStealer communicates externally via HTTP POST with encrypted content.

StrelaStealer variants collect victim system information for exfiltration.

StrelaStealer installers have used obfuscated PowerShell scripts to retrieve follow-on payloads from WebDAV servers.

StrelaStealer attempts to identify and collect mail login data from Thunderbird and Outlook following execution.

StrelaStealer utilizes a hard-coded XOR key to encrypt the content of HTTP POST requests to command and control infrastructure.

StrelaStealer payloads have included strings encrypted via XOR. StrelaStealer JavaScript payloads utilize Base64-encoded payloads that are decoded via certutil to create a malicious DLL file.

StrelaStealer relies on user execution of a malicious file for installation.

StrelaStealer DLL payloads have been executed via `rundll32.exe`.

StrelaStealer variants only execute if the keyboard layout or language matches a set list of variables.

StrelaStealer variants include the use of mutex values based on the victim system name to prevent reinfection.

StrelaStealer payloads have used control flow obfuscation techniques such as excessively long code blocks of mathematical instructions to defeat sandboxing and related analysis methods.

StrelaStealer variants use COM objects to enumerate installed applications from the "AppsFolder" on victim machines.

StrelaStealer searches for and if found collects the contents of files such as `logins.json` and `key4.db` in the `$APPDATA%\Thunderbird\Profiles\` directory, associated with the Thunderbird email application.

StrelaStealer enumerates the registry key `HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\` to identify the values for "IMAP User," "IMAP Server," and "IMAP Password" associated with the Outlook email application.

StrelaStealer variants have used valid code signing certificates.

StrelaStealer has been distributed as a spearphishing attachment.

StrelaStealer has sideloaded a DLL payload using a renamed, legitimate `msinfo32.exe` executable.

StrelaStealer variants check system language settings via keyboard layout or similar mechanisms.

StrelaStealer variants include functionality to identify and evade debuggers.