Sunday, April 14, 2024

StrelaStealer Malware Hacked 100+ Organizations Across The EU And U.S

Strelastealer malware has been found to be distributed in large-scale campaigns that have currently impacted over 100 organizations across the U.S. and EU.

The malware was first discovered in 2022 and is capable of stealing a victim’s email login information and exfiltrating it to the threat actor’s C2 server.

However, the current campaigns were conducted in the form of spam emails with attachments for launching the StrelaStealer’s DLL payload.

As a means of evading detection at email gateways, threat actors have been changing the file format which prevents the matching of signatures and patterns.

Moreover, the last campaign conducted by the threat actors dates back to November 2023.

StrelaStealer Malware

According to the reports shared by Unit 42 researchers, the malware authors have been updating the DLL payload with better obfuscations and anti-analysis methods for making it extremely hard for analysts and security products to analyze the samples.


Free Webinar : Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.:

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

AcuRisQ, which helps you to quantify risk accurately:

Though several tactics have been used, the malware can still be detected due to the identifiable “strela” string in the DLL payload.

Nevertheless, the new variant of the malware is delivered as a zipped JScript, which employs an updated obfuscation technique in the DLL payload. 

The spam emails usually had the subject line with patterns of Factura (Bill – Spanish)/Rechnung (The invoice – German) /invoice###.

Moreover, it has also been discovered that the threat actors have been heavily targeting high-tech industries with this malware.

Example spam email from campaign (Source: Unit 42)

Malware Analysis

StrelaStealer’s previous variants involve the use of ISO files that contain an LNK file and an HTML file.

Additionally, the malware also used polyglot files that vary based on the applications being executed. 

Infection chain (Source: Unit 42)

When a victim clicks on the LNK file inside the ISO file, the HTML file is executed, which invokes the execution of the embedded StrelaStealer payload via rundll32.exe.

The initial DLL payload is encrypted which is decrypted during execution with the help of a constant XOR key, Unit 42 researchers said.

As of the current variant of the malware, the threat actors have been using spear-phishing emails with ZIP file attachments, which, when downloaded and opened, drop a JScript file on the system. 

Comparison between old and new version of StrelaStealer (Source: Unit 42)

Following this, the JScript file drops another base64-encrypted file and a batch file.

The base64-encrypted file is embedded with certutil -f decode command which will create a Portable Executable DLL file which is dropped into either %appdata%\temp or c:\temp based on the user’s privilege.

This DLL file is then executed using the exported hello function that uses the rundll32.exe process.

Moreover, the packer of the new variant also uses a control flow obfuscation technique which has a long code block containing numerous arithmetic functions for the purpose of preventing analysis of the malware by analysts and security products.

The payload size and the decryption key depends on the configuration of the payload.

Though the file attachments for every spam email differs, the presence of strings like strela, server.php, key4.db and login.json indicates their association with StrelaStealer malware.

Furthermore, the configuration of the payload also includes the communication with the C2 server for exfiltrating the email login data from the victims.

C2 server name mentioned in the StrelaStealer malware string (Source: Unit 42)

Indicators Of Compromise

SHA256 HashFiletype
193[.]109[.]85[.]231C2 server

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.


Latest articles

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...

Hackers Employ Deepfake Technology To Impersonate as LastPass CEO

A LastPass employee recently became the target of an attempted fraud involving sophisticated audio...

Sisence Data Breach, CISA Urges To Reset Login Credentials

In response to a recent data breach at Sisense, a provider of data analytics...

DuckDuckGo Launches Privacy Pro: 3-in-1 service With VPN

DuckDuckGo has launched Privacy Pro, a new subscription service that promises to enhance user...

Cyber Attack Surge by 28%:Education Sector at High Risk

In Q1 2024, Check Point Research (CPR) witnessed a notable increase in the average...

Midnight Blizzard’s Microsoft Corporate Email Hack Threatens Federal Agencies: CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive concerning a...
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles