Friday, November 11, 2022
HomeHackerStrelaStealer Malware Stealing Outlook & Thunderbird Credentials

StrelaStealer Malware Stealing Outlook & Thunderbird Credentials


Safety analysts at DCSO CyTec have not too long ago recognized that the Outlook and Thunderbird shoppers have been focused by a brand new information-stealing malware known as StrelaStealer (“Стрела” == arrow) particularly it steals account credentials.

The demeanor of this information-stealer differs from that of the bulk stealers, which goal totally different sources of knowledge, similar to:-

  • Net browsers
  • Cryptocurrency pockets apps
  • Cloud gaming apps
  • Clipboard

Early in November 2022, DCSO CyTec found StrelaStealer for the primary time. Based mostly on the lure paperwork used within the assault, it seems that it’s distributed by way of ISO recordsdata with Spanish targets connected to them. 

Presently, it’s not clear if StrelaStealer is a part of a focused assault or if it was a part of a hacker’s work to unfold the an infection.

An infection Chain

Within the type of ISO recordsdata, this data stealer is delivered to the sufferer’s pc by way of e-mail attachment to contaminate the sufferer’s system.

In accordance with the report, StrelaStealer might be sideloaded as slc.dll and that is accomplished via using a renamed model of msinfo32.exe. Whereas other than this, within the type of a DLL/HTML polyglot file, the StrelaStealer may also be distributed.

The time period polyglot file refers to a file that may be learn by two or extra totally different file codecs on the similar time. Whereas within the case of StrelaStealer, it makes use of a file that’s each legitimate as a:-

There are two recordsdata contained within the ISO file, and right here they’re talked about under:-

A file known as “x.html” is executed two occasions by the primary file (LNK file). Initially, it’ll be accomplished within the type of a DLL, after which within the type of an HTML file.

In an effort to make the assault seem much less suspicious, the default internet browser is opened as soon as the malware is loaded into reminiscence to show the decoy.

StrelaStealer

In an effort to discover the logins.json and key4.db recordsdata, StrelaStealer searches the next listing when it executes:-

  • %APPDATApercentThunderbirdProfiles

As quickly as it’s accomplished, it would exfiltrate all of the out there contents of these recordsdata to the C2 server. Upon retrieving the software program’s key from the Home windows Registry, StrelaStealer finds the next values for Outlook:-

  • IMAP Person
  • IMAP Server
  • IMAP Password

It’s designed to securely talk over plain HTTP POSTs utilizing xor keys for each the strings and the payload. There are hard-coded C2 servers and useful resource names which can be utilized by the stealer.

Furthermore, this malware could also be utilized in extremely focused assaults since it’s unfold utilizing Spanish-language lures.

Indicators of Compromise

sha256
fa1295c746e268a3520485e94d1cecc77e98655a6f85d42879a3aeb401e5cf15
c8eb6efc2cd0bd10d9fdd4f644ebbebdebaff376ece9e48ff502f973fe837820
8b0d8651e035fcc91c39b3260c871342d1652c97b37c86f07a561828b652e907
879ddb21573c5941f60f43921451e420842f1b0ff5d8eccabe11d95c7b9b281e
b7e2e4df5cddcbf6c0cda0fb212be65dea2c442e06590461bf5a13821325e337
d8d28aa1df354c7e0798279ed3fecad8effef8c523c701faaf9b5472d22a5e28
ac040049e0ddbcb529fb2573b6eced3cfaa6cd6061ce2e7a442f0ad67265e800
bfc30cb876b45bc7c5e7686a41a155d791cd13309885cb6f9c05e001eca1d28a
6e8a3ffffd2f7a91f3f845b78dd90011feb80d30b4fe48cb174b629afa273403
c69bac4620dcf94acdee3b5e5bcd73b88142de285eea59500261536c1513ab86
be9f84b19f02f16b7d8a9148a68ad8728cc169668f2c59f918d019bce400d90e
1437a2815fdb82c7e590c1e6f4b490a7cdc7ec81a6cb014cd3ff712304e4c9a3
Pdb path:
C:UsersadminsourcereposDll1ReleaseDll1.pdb
"C:UsersSerhiiDocumentsVisual Studio 2008ProjectsStrelaDLLCompileReleaseStrelaDLLCompile.pdb"
C2 server:
193.106.191[.]166
hxxp://193.106.191[.]166/server.php
ITW URL:
hxxp://45.142.212[.]20/dll.dll

Managed DDoS Assault Safety for Functions – Obtain Free Information

RELATED ARTICLES

LEAVE A REPLY

Please enter your comment!
Please enter your name here

- Advertisment -
Google search engine

Most Popular

Recent Comments