Monday, July 15, 2024

Hackers Stealing Outlook and Thunderbird Credentials Using StrelaStealer Malware

Security analysts at DCSO CyTec have recently identified that the Outlook and Thunderbird clients have been targeted by a new information-stealing malware called StrelaStealer (“Стрела” == arrow) specifically it steals account credentials.

The demeanor of this information-stealer differs from that of the majority stealers, which target different sources of information, such as:-

  • Web browsers
  • Cryptocurrency wallet apps
  • Cloud gaming apps
  • Clipboard

Early in November 2022, DCSO CyTec discovered StrelaStealer for the first time. Based on the lure documents used in the attack, it appears that it is distributed via ISO files with Spanish targets attached to them. 

Currently, it is not clear if StrelaStealer is part of a targeted attack or if it was part of a hacker’s work to spread the infection.

Infection Chain

In the form of ISO files, this information stealer is delivered to the victim’s computer via email attachment to infect the victim’s system.

According to the report, StrelaStealer can be sideloaded as slc.dll and this is done through the use of a renamed version of msinfo32.exe. While apart from this, in the form of a DLL/HTML polyglot file, the StrelaStealer can also be distributed.

The term polyglot file refers to a file that can be read by two or more different file formats at the same time. While in the case of StrelaStealer, it uses a file that is both valid as a:-

  • DLL
  • HTML
Infection Chain

There are two files contained in the ISO file, and here they are mentioned below:-

  • Factura.lnk
  • x.html file

A file called “x.html” is executed two times by the first file (LNK file). Initially, it is going to be done in the form of a DLL, and then in the form of an HTML file.

In order to make the attack appear less suspicious, the default web browser is opened once the malware is loaded into memory to display the decoy.


In order to find the logins.json and key4.db files, StrelaStealer searches the following directory when it executes:-

  • %APPDATA%\Thunderbird\Profiles\

As soon as it is completed, it will exfiltrate all the available contents of those files to the C2 server. Upon retrieving the software’s key from the Windows Registry, StrelaStealer finds the following values for Outlook:-

  • IMAP User
  • IMAP Server
  • IMAP Password

It is designed to securely communicate over plain HTTP POSTs using xor keys for both the strings and the payload. There are hard-coded C2 servers and resource names that are used by the stealer.

Moreover, this malware may be used in highly targeted attacks since it is spread using Spanish-language lures.

Indicators of Compromise

Pdb path:
"C:\Users\Serhii\Documents\Visual Studio 2008\Projects\StrelaDLLCompile\Release\StrelaDLLCompile.pdb"
C2 server:

Managed DDoS Attack Protection for Applications – Download Free Guide


Latest articles

Critical Cellopoint Secure Email Gateway Flaw Let Attackers Execute Arbitrary Code

A critical vulnerability has been discovered in the Cellopoint Secure Email Gateway, identified as...

Singapore Banks to Phase out OTPs for Bank Account Logins Within 3 Months

The Monetary Authority of Singapore (MAS) and The Association of Banks in Singapore (ABS)...

GuardZoo Android Malware Attacking military personnel via WhatsApp To Steal Sensitive Data

A Houthi-aligned group has been deploying Android surveillanceware called GuardZoo since October 2019 to...

ViperSoftX Weaponizing AutoIt & CLR For Stealthy PowerShell Execution

ViperSoftX is an advanced malware that has become more complicated since its recognition in...

Malicious NuGet Campaign Tricking Developers To Inject Malicious Code

Hackers often target NuGet as it's a popular package manager for .NET, which developers...

Akira Ransomware Attacking Airline Industry With Legitimate Tools

Airlines often become the target of hackers as they contain sensitive personal and financial...

DarkGate Malware Exploiting Excel Files And SMB File Shares

DarkGate, a Malware-as-a-Service (MaaS) platform, experienced a surge in activity since September 2023, employing...

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles