AhnLab Security Emergency response Center (ASEC) analysis team has recently confirmed the StrelaStealer Infostealer being distributed to Spanish users. StrelaStealer was initially discovered around November 2022 and has been distributed as an attachment to spam emails. In the past, ISO files were used as attachments, but recently, ZIP files have been utilized instead.
Figure 1. Distributed email
The email that is being distributed is similar to the one shown in Figure 1. The email body and the name of the attached compressed file are in Spanish, and the email contains a message about payment fees, instructing users to check the attached invoice.
Figure 2. Inside the compressed file
The attachment is a ZIP that contains a PIF file. This PIF file is the StrelaStealer malware that performs the actual malicious behaviors and steals email account credentials.
Figure 3. Actual main function
Upon execution, a mutex is first created using the XOR [6-digit] value of the strings “computer name” and “strela”. It then proceeds to collect information from Thunderbird and Outlook. If no relevant information is found, it generates a message box and self-terminates.
Figure 4. Intentional error message
The message box is written in Spanish like the email, and contains a message claiming that the file is corrupted and cannot be opened. Seeing this message box, users are led to believe that they have a corrupted file, making it difficult for them to realize that malware had been executed.
Figure 5. Collecting information from Thunderbird
The first piece of information that it steals is the account credentials from Thunderbird. The files in the directories below are read and sent to a C2.
- %AppData%\Thunderbird\Profiles\[Profile name]\logins.json
- %AppData%\Thunderbird\Profiles\[Profile name]\key4.db
Figure 6. Collecting information from Outlook
The second piece of information that is stolen is the account credentials from Outlook. The following registry values are read and the data is sent to a C2. In addition, for the “IMAP Password” value, it decrypts the data using the CryptUnprotectData API before transmitting it.
- HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\IMAP Password
- HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\IMAP User
- HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\IMAP Server
The C2 to which the collected information is sent to is as follows. The string “KH” is checked for as a response value to verify successful reception.
- C2 – hxxp://91.215.85[.]209/server.php
Recently there have been malware distribution cases targeting Spanish users to steal email account credentials. Caution is advised due to the possibility of the exfiltrated information being used to cause additional harm. Users should refrain from opening emails from unknown sources and should not execute their attachments. Users should also regularly scan their PCs and update their security products to the latest engine.
[File Detection]
Trojan/Win.Generic.R577470 (2023.05.14.01)
[IOC]
ba5281c2978e426605f4be767898b323
hxxp://91.215.85[.]209/server.php
Subscribe to AhnLab’s next-generation threat intelligence platform ‘AhnLab TIP’ to check related IOC and detailed analysis information.
The post StrelaStealer Being Distributed To Spanish Users appeared first on ASEC BLOG.
Article Link: StrelaStealer Being Distributed To Spanish Users - ASEC BLOG