StrelaStealer Malware Hijacking Outlook and Thunderbird Accounts

The cyber security researchers at DCSO CyTec have discovered a brand-new information-stealing malware targeting Outlook and Thunderbird emails.

Dubbed StrelaStealer, the malware acts just like any other info stealer and tries to steal data from browsers, cloud gaming apps, cryptocurrency wallet apps, the clipboard, and other sources. However, what’s unique about this campaign is that the malware steals data from Thunderbird and Outlook accounts and targets Spanish-speaking people.

Attack Chain Analysis

The malware was detected earlier this month. The attack chain involves sending email attachments to the targeted user. These attachments contain ISO files. When a user clicks on the file, it opens an executable (msinfo32.exe). It then sideloads the bundled malware through DLL order hijacking.

In some cases, the ISO contains a .lnk file (Factura.Ink) and an HTML document that’s a polyglot file (x.html). Such as, when you open an HTML file on a web browser, you will see a text document, and when it is opened via an executable, it installs the payload.

Related News

1. VirusTotal Reveals Apps Most Exploited to Spread Malware
2. Urlscan.io API Inadvertently Leaked Sensitive Data and URLs
3. Microsoft Office Most Exploited Software in Malware Attacks
4. Apple Safari Safest, Google Chrome Riskiest Browser of 2022
5. Top 10 Android Educational Apps That Collect Most User Data

How does the Attack Works?

According to DCSO CyTec’s blog post, when the user clicks on the .lnk file, it executes the x.html twice. First, it executes it using rundll32.exe and opens the embedded StrelaStealer DLL. Then it opens the HTML file in the device’s default browser to reveal a decoy document.

While the user is busy checking this document, the info stealer starts its malicious tasks in the background. Such as, it searches for login.json and key4.db in %APPDATA%ThunderbirdProfiles directory for stealing account credentials.

In Outlook’s case, the malware accesses the Windows Registry and steals the software’s key, after which it inspects the IMAP User, IMAP Password, and IMAP Server values. If found, the malware exfiltrates the content to a C2 server controlled by the attacker.

Then it waits for the attacker’s response. If received, the malware quits. If not, it repeats the routine after a 1-second sleep session.

In conclusion, email attachments can be a great way to share information and files with others, but they can also be a source of malware. By following some simple guidelines, you can protect yourself from malicious email attachments.

First, never open an attachment from someone you don’t know. If you’re not expecting an attachment from the sender, be wary of opening it. Second, always scan attachments for viruses before opening them. Many email programs will do this automatically, but if yours doesn’t, there are many free virus scanners available online.

Finally, make sure you have an updated security solution installed on your system. One can also use VirusTotal to scan malicious files and URLs.