What Is StrelaStealer?
StrelaStealer (S1183) is an information-stealing malware designed to silently harvest email account credentials. Emerging in late 2022, threat actors use it primarily to target Microsoft Outlook and Mozilla Thunderbird users. Financially motivated Initial Access Brokers (IABs) and threat clusters like HIVE-0145 often operate StrelaStealer to steal logins and sell network access to other criminal groups.
Cybercriminals distribute StrelaStealer through large-scale phishing campaigns. Attackers attach malicious ZIP or ISO archives containing JavaScript, LNK files, or PowerShell scripts to disguised emails. When executed, the script downloads and registers a malicious payload directly into the system memory, often using native utilities like rundll32.exe to execute malicious DLLs.
StrelaStealer employs advanced anti-analysis techniques to bypass security controls. The malware developers pad the malicious file with excessive mathematical functions to slow execution and defeat automated sandbox analysis. The software also checks the victim’s keyboard layout and system language, stopping the infection process if the system does not match targeted regions. Once successfully installed, the malware targets Thunderbird’s logins.json and Outlook’s registry profiles. It then encrypts the stolen login data and automatically sends it to external command-and-control servers via XOR-encrypted HTTP POST requests.
How to Defend Against StrelaStealer?
Defending against StrelaStealer requires strict email security, behavioral endpoint monitoring, and automated threat intelligence.
- Secure the email vector: StrelaStealer relies on malicious ZIP and ISO attachments and phishing lures. Implement strong email filtering to quarantine suspicious archives, block dangerous file extensions like ISO or LNK, and inspect embedded scripts before they reach users.
- Monitor endpoint behaviors: StrelaStealer relies on native Windows processes to execute its payloads. Deploy endpoint detection tools to inspect utilities like PowerShell and rundll32.exe for unusual command-line executions and memory injections.
- Eliminate network blind spots: Infostealers exploit unmonitored assets and shadow IT to harvest credentials. Use platforms like Lumu Discover to map your attack surface, identify unmanaged systems, and eliminate blind spots.
- Track abnormal network behaviors: The malware sends stolen credentials to external servers using encrypted HTTP POST requests. Deploy Network Detection and Response (NDR) platforms like Lumu Defender to flag suspicious outbound connections, detect XOR-encrypted data anomalies, and block command-and-control communication.
- Block malicious indicators: Leverage threat intelligence platforms like Lumu Maltiverse to automatically correlate and block known infrastructure, domains, and IP addresses linked to infostealer campaigns.
