StrelaStealer Malware Hacked 100+ Organizations Across The EU And U.S

Strelastealer malware has been found to be distributed in large-scale campaigns that have currently impacted over 100 organizations across the U.S. and EU.

The malware was first discovered in 2022 and is capable of stealing a victim’s email login information and exfiltrating it to the threat actor’s C2 server.

However, the current campaigns were conducted in the form of spam emails with attachments for launching the StrelaStealer’s DLL payload.

As a means of evading detection at email gateways, threat actors have been changing the file format which prevents the matching of signatures and patterns.

Moreover, the last campaign conducted by the threat actors dates back to November 2023.

StrelaStealer Malware

According to the reports shared by Unit 42 researchers, the malware authors have been updating the DLL payload with better obfuscations and anti-analysis methods for making it extremely hard for analysts and security products to analyze the samples.

Free Webinar : Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities. :

• The problem of vulnerability fatigue today
• Difference between CVSS-specific vulnerability vs risk-based vulnerability
• Evaluating vulnerabilities based on the business impact/risk
• Automation to reduce alert fatigue and enhance security posture significantly

AcuRisQ, which helps you to quantify risk accurately:

Book Your spot

Though several tactics have been used, the malware can still be detected due to the identifiable “strela” string in the DLL payload.

Nevertheless, the new variant of the malware is delivered as a zipped JScript, which employs an updated obfuscation technique in the DLL payload. 

The spam emails usually had the subject line with patterns of Factura (Bill – Spanish)/Rechnung (The invoice – German) /invoice###.

Moreover, it has also been discovered that the threat actors have been heavily targeting high-tech industries with this malware.

Malware Analysis

StrelaStealer’s previous variants involve the use of ISO files that contain an LNK file and an HTML file.

Additionally, the malware also used polyglot files that vary based on the applications being executed. 

When a victim clicks on the LNK file inside the ISO file, the HTML file is executed, which invokes the execution of the embedded StrelaStealer payload via rundll32.exe.

The initial DLL payload is encrypted which is decrypted during execution with the help of a constant XOR key, Unit 42 researchers said.

As of the current variant of the malware, the threat actors have been using spear-phishing emails with ZIP file attachments, which, when downloaded and opened, drop a JScript file on the system. 

Following this, the JScript file drops another base64-encrypted file and a batch file.

The base64-encrypted file is embedded with certutil -f decode command which will create a Portable Executable DLL file which is dropped into either %appdata%\temp or c:\temp based on the user’s privilege.

This DLL file is then executed using the exported hello function that uses the rundll32.exe process.

Moreover, the packer of the new variant also uses a control flow obfuscation technique which has a long code block containing numerous arithmetic functions for the purpose of preventing analysis of the malware by analysts and security products.

The payload size and the decryption key depends on the configuration of the payload.

Though the file attachments for every spam email differs, the presence of strings like strela, server.php, key4.db and login.json indicates their association with StrelaStealer malware.

Furthermore, the configuration of the payload also includes the communication with the C2 server for exfiltrating the email login data from the victims.

Indicators Of Compromise

SHA256 Hash	Filetype
0d2d0588a3a7cff3e69206be3d75401de6c69bcff30aa1db59d34ce58d5f799ae6991b12e86629b38e178fef129dfda1d454391ffbb236703f8c026d6d55b9a1	DLL
f95c6817086dc49b6485093bfd370c5e3fc3056a5378d519fd1f5619b30f3a2eaea9989e70ffa6b1d9ce50dd3af5b7a6a57b97b7401e9eb2404435a8777be054b8e65479f8e790ba627d0deb29a3631d1b043160281fe362f111b0e080558680	EML
3189efaf2330177d2817cfb69a8bfa3b846c24ec534aa3e6b66c8a28f3b18d4b	ZIP
544887bc3f0dccb610dd7ba35b498a03ea32fca047e133a0639d5bca61cc6f45	JS
193[.]109[.]85[.]231	C2 server

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.