Thursday, March 28, 2024

Hackers Stealing Outlook and Thunderbird Credentials Using StrelaStealer Malware

Security analysts at DCSO CyTec have recently identified that the Outlook and Thunderbird clients have been targeted by a new information-stealing malware called StrelaStealer (“Стрела” == arrow) specifically it steals account credentials.

The demeanor of this information-stealer differs from that of the majority stealers, which target different sources of information, such as:-

  • Web browsers
  • Cryptocurrency wallet apps
  • Cloud gaming apps
  • Clipboard

Early in November 2022, DCSO CyTec discovered StrelaStealer for the first time. Based on the lure documents used in the attack, it appears that it is distributed via ISO files with Spanish targets attached to them. 

Currently, it is not clear if StrelaStealer is part of a targeted attack or if it was part of a hacker’s work to spread the infection.

Infection Chain

In the form of ISO files, this information stealer is delivered to the victim’s computer via email attachment to infect the victim’s system.

According to the report, StrelaStealer can be sideloaded as slc.dll and this is done through the use of a renamed version of msinfo32.exe. While apart from this, in the form of a DLL/HTML polyglot file, the StrelaStealer can also be distributed.

The term polyglot file refers to a file that can be read by two or more different file formats at the same time. While in the case of StrelaStealer, it uses a file that is both valid as a:-

  • DLL
  • HTML
Infection Chain

There are two files contained in the ISO file, and here they are mentioned below:-

  • Factura.lnk
  • x.html file

A file called “x.html” is executed two times by the first file (LNK file). Initially, it is going to be done in the form of a DLL, and then in the form of an HTML file.

In order to make the attack appear less suspicious, the default web browser is opened once the malware is loaded into memory to display the decoy.

StrelaStealer

In order to find the logins.json and key4.db files, StrelaStealer searches the following directory when it executes:-

  • %APPDATA%\Thunderbird\Profiles\

As soon as it is completed, it will exfiltrate all the available contents of those files to the C2 server. Upon retrieving the software’s key from the Windows Registry, StrelaStealer finds the following values for Outlook:-

  • IMAP User
  • IMAP Server
  • IMAP Password

It is designed to securely communicate over plain HTTP POSTs using xor keys for both the strings and the payload. There are hard-coded C2 servers and resource names that are used by the stealer.

Moreover, this malware may be used in highly targeted attacks since it is spread using Spanish-language lures.

Indicators of Compromise

sha256
fa1295c746e268a3520485e94d1cecc77e98655a6f85d42879a3aeb401e5cf15
c8eb6efc2cd0bd10d9fdd4f644ebbebdebaff376ece9e48ff502f973fe837820
8b0d8651e035fcc91c39b3260c871342d1652c97b37c86f07a561828b652e907
879ddb21573c5941f60f43921451e420842f1b0ff5d8eccabe11d95c7b9b281e
b7e2e4df5cddcbf6c0cda0fb212be65dea2c442e06590461bf5a13821325e337
d8d28aa1df354c7e0798279ed3fecad8effef8c523c701faaf9b5472d22a5e28
ac040049e0ddbcb529fb2573b6eced3cfaa6cd6061ce2e7a442f0ad67265e800
bfc30cb876b45bc7c5e7686a41a155d791cd13309885cb6f9c05e001eca1d28a
6e8a3ffffd2f7a91f3f845b78dd90011feb80d30b4fe48cb174b629afa273403
c69bac4620dcf94acdee3b5e5bcd73b88142de285eea59500261536c1513ab86
be9f84b19f02f16b7d8a9148a68ad8728cc169668f2c59f918d019bce400d90e
1437a2815fdb82c7e590c1e6f4b490a7cdc7ec81a6cb014cd3ff712304e4c9a3
Pdb path:
C:\Users\admin\source\repos\Dll1\Release\Dll1.pdb
"C:\Users\Serhii\Documents\Visual Studio 2008\Projects\StrelaDLLCompile\Release\StrelaDLLCompile.pdb"
C2 server:
193.106.191[.]166
hxxp://193.106.191[.]166/server.php
ITW URL:
hxxp://45.142.212[.]20/dll.dll

Managed DDoS Attack Protection for Applications – Download Free Guide

Website

Latest articles

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles