DCSO StrelaStealer 2022

StrelaStealer encrypts the payload of HTTP POST communications using the same XOR key used for the malware's DLL payload.

StrelaStealer automatically sends gathered email credentials following collection to command and control servers via HTTP POST.

StrelaStealer has been distributed in ISO archives. StrelaStealer has been delivered in encrypted, password-protected ZIP archives.

StrelaStealer uses XOR-encoded strings to obfuscate items.

StrelaStealer has used a renamed, legitimate `msinfo32.exe` executable to sideload the StrelaStealer payload during initial installation.

StrelaStealer has been distributed as a DLL/HTML polyglot file.

StrelaStealer exfiltrates collected email credentials via HTTP POST to command and control servers.

StrelaStealer communicates externally via HTTP POST with encrypted content.

StrelaStealer attempts to identify and collect mail login data from Thunderbird and Outlook following execution.

StrelaStealer payloads have included strings encrypted via XOR. StrelaStealer JavaScript payloads utilize Base64-encoded payloads that are decoded via certutil to create a malicious DLL file.

StrelaStealer relies on user execution of a malicious file for installation.

StrelaStealer searches for and if found collects the contents of files such as `logins.json` and `key4.db` in the `$APPDATA%\Thunderbird\Profiles\` directory, associated with the Thunderbird email application.

StrelaStealer enumerates the registry key `HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\` to identify the values for "IMAP User," "IMAP Server," and "IMAP Password" associated with the Outlook email application.

StrelaStealer has been distributed as a spearphishing attachment.

StrelaStealer has sideloaded a DLL payload using a renamed, legitimate `msinfo32.exe` executable.