Fortgale StrelaStealer 2023

StrelaStealer has been delivered via JScript files in a ZIP archive.

StrelaStealer variants have included excessive mathematical functions padding the binary and slowing execution for anti-analysis and sandbox evasion purposes.

StrelaStealer exfiltrates collected email credentials via HTTP POST to command and control servers.

StrelaStealer has included BAT files in some instances for installation.

StrelaStealer has been distributed as a malicious JavaScript object.

StrelaStealer communicates externally via HTTP POST with encrypted content.

StrelaStealer attempts to identify and collect mail login data from Thunderbird and Outlook following execution.

StrelaStealer payloads have included strings encrypted via XOR. StrelaStealer JavaScript payloads utilize Base64-encoded payloads that are decoded via certutil to create a malicious DLL file.

StrelaStealer variants only execute if the keyboard layout or language matches a set list of variables.

StrelaStealer variants include the use of mutex values based on the victim system name to prevent reinfection.

StrelaStealer payloads have used control flow obfuscation techniques such as excessively long code blocks of mathematical instructions to defeat sandboxing and related analysis methods.

StrelaStealer searches for and if found collects the contents of files such as `logins.json` and `key4.db` in the `$APPDATA%\Thunderbird\Profiles\` directory, associated with the Thunderbird email application.

StrelaStealer enumerates the registry key `HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\` to identify the values for "IMAP User," "IMAP Server," and "IMAP Password" associated with the Outlook email application.

StrelaStealer variants check system language settings via keyboard layout or similar mechanisms.

StrelaStealer variants include functionality to identify and evade debuggers.