StrelaStealer Malware Hacked 100+ Organizations

Strelastealer malware has been found to be distributed in large-scale campaigns that have currently impacted over 100 organizations across the U.S. and EU.

The malware was first discovered in 2022 and is capable of stealing a victim’s email login information and exfiltrating it to the threat actor’s C2 server.

However, the current campaigns were conducted in the form of spam emails with attachments for launching the StrelaStealer’s DLL payload.

As a means of evading detection at email gateways, threat actors have been changing the file format which prevents the matching of signatures and patterns.

Moreover, the last campaign conducted by the threat actors dates back to November 2023.

StrelaStealer Malware

According to the reports shared by Unit 42 researchers, the malware authors have been updating the DLL payload with better obfuscations and anti-analysis methods for making it extremely hard for analysts and security products to analyze the samples.

Though several tactics have been used, the malware can still be detected due to the identifiable “strela” string in the DLL payload.

Nevertheless, the new variant of the malware is delivered as a zipped JScript, which employs an updated obfuscation technique in the DLL payload. 

The spam emails usually had the subject line with patterns of Factura (Bill – Spanish)/Rechnung (The invoice – German) /invoice###.

Moreover, it has also been discovered that the threat actors have been heavily targeting high-tech industries with this malware.

Malware Analysis

StrelaStealer’s previous variants involve the use of ISO files that contain an LNK file and an HTML file.

Additionally, the malware also used polyglot files that vary based on the applications being executed. 

When a victim clicks on the LNK file inside the ISO file, the HTML file is executed, which invokes the execution of the embedded StrelaStealer payload via rundll32.exe.

The initial DLL payload is encrypted which is decrypted during execution with the help of a constant XOR key, Unit 42 researchers said.

As of the current variant of the malware, the threat actors have been using spear-phishing emails with ZIP file attachments, which, when downloaded and opened, drop a JScript file on the system. 

Following this, the JScript file drops another base64-encrypted file and a batch file.

The base64-encrypted file is embedded with certutil -f decode command which will create a Portable Executable DLL file which is dropped into either %appdata%temp or c:temp based on the user’s privilege.

This DLL file is then executed using the exported hello function that uses the rundll32.exe process.

Moreover, the packer of the new variant also uses a control flow obfuscation technique which has a long code block containing numerous arithmetic functions for the purpose of preventing analysis of the malware by analysts and security products.

The payload size and the decryption key depends on the configuration of the payload.

Though the file attachments for every spam email differs, the presence of strings like strela, server.php, key4.db and login.json indicates their association with StrelaStealer malware.

Furthermore, the configuration of the payload also includes the communication with the C2 server for exfiltrating the email login data from the victims.

Indicators Of Compromise

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.