StrelaStealer Malwa

Overview

The StrelaStealer malware has emerged as a significant cybersecurity threat, primarily through phishing campaigns targeting over 100 organizations across the European Union and the United States. The malware is designed to exfiltrate email login credentials from popular clients like Outlook and Thunderbird, sending the stolen data to an attacker-controlled server.

Impact

This malware has a broad impact across various sectors including high tech, finance, professional and legal services, manufacturing, government, energy, insurance, and construction.

Attack Vector

StrelaStealer is distributed via spam emails containing malicious attachments. These emails carry ZIP files that include JavaScript files, which in turn deploy a batch file to launch StrelaStealer's DLL payload using a legitimate Windows component. The malware employs updated obfuscation techniques in the DLL payload to evade detection.

Indicators of Compromise (IoCs)

• IP Addresses: 193[.]109[.]85[.]231
• Hashes:
  • 0d2d0588a3a7cff3e69206be3d75401de6c69bcff30aa1db59d34ce58d5f799a
  • aea9989e70ffa6b1d9ce50dd3af5b7a6a57b97b7401e9eb2404435a8777be054
  • 3189efaf2330177d2817cfb69a8bfa3b846c24ec534aa3e6b66c8a28f3b18d4b
  • f95c6817086dc49b6485093bfd370c5e3fc3056a5378d519fd1f5619b30f3a2e
  • e6991b12e86629b38e178fef129dfda1d454391ffbb236703f8c026d6d55b9a1
  • 544887bc3f0dccb610dd7ba35b498a03ea32fca047e133a0639d5bca61cc6f45
  • b8e65479f8e790ba627d0deb29a3631d1b043160281fe362f111b0e080558680

Mitigation Steps

• Exercise caution with unsolicited emails, especially those with attachments themed around invoices.
• Deploy advanced email filtering to detect and block phishing attempts.
• Educate employees on the risks associated with phishing and the dangers of opening unknown attachments.
• Maintain updated antivirus and anti-malware solutions.
• Regular backups are essential for mitigating the impact of data theft.

Recommendations

Organizations and individuals are urged to monitor for signs of compromise and consider security audits to ensure defenses are current. Changing email passwords regularly and enabling two-factor authentication are advised for enhancing security.

For further details, the research by Palo Alto Networks Unit 42 provides an extensive analysis of the StrelaStealer malware campaign.

Sources

• Securitricks: Provides a detailed analysis of the StrelaStealer malware campaign, including technical descriptions and indicators of compromise. Securitricks Report
• BleepingComputer: Offers insights into the StrelaStealer malware, focusing on its unique methods of stealing email account credentials from Outlook and Thunderbird clients. BleepingComputer Article
• DCSO CyTec: Initially identified the StrelaStealer malware, providing early detection and analysis focused on its targeting of Spanish-speaking users. DCSO CyTec on Medium
• Palo Alto Networks Unit 42: Conducted comprehensive research on the StrelaStealer malware campaign, highlighting its impact and suggesting mitigation steps. Palo Alto Networks Unit 42 Research
• The Hacker News: Reported on the new wave of StrelaStealer phishing attacks targeting organizations in the EU and U.S., emphasizing the malware's capability to extract email login data. The Hacker News Article
• Cyware: Mentioned the large-scale StrelaStealer campaign in early 2024, contributing to the awareness and understanding of this significant cyber threat. Cyware News
• Cybernews: Highlighted the novel malware's focus on Outlook and Thunderbird accounts, adding to the discourse on email client vulnerabilities. Cybernews Report

Disclaimer

This advisory is based on the latest information available and may be subject to updates as new data emerges. It is recommended to follow the mitigation steps and stay updated on the threat landscape [❞] [❞].