⚠️ Overview

StrelaStealer is an information-stealing malware first documented in November 2021 by cybersecurity researchers at Trend Micro, attributed to a Russian-speaking threat actor tracked as TA544 (also identified as Gold Rye). It belongs to the stealer category, specifically designed to harvest email credentials from Microsoft Outlook and Mozilla Thunderbird clients.

🔧 Technical Capabilities

StrelaStealer propagates via phishing emails containing weaponized Microsoft Office documents (e.g., .docx, .xls) with malicious macros that download the stealer payload. Its attack vector exploits CVE-2017-11882 (Microsoft Office Equation Editor remote code execution) and CVE-2018-0802 to execute shellcode. The malware establishes C2 communication over HTTP POST requests to hardcoded IP addresses (e.g., 45.132.105[.]210) using custom encryption (XOR with a key). Persistence is achieved via registry Run keys, while evasion techniques include API hashing to obfuscate system calls, process hollowing into legitimate processes like svchost.exe, and delaying execution to bypass sandbox analysis. It collects credentials from Outlook’s Protected Storage API and Thunderbird’s Signons SQLite database, exfiltrating them as base64-encoded data before self-deleting.

📜 History & Notable Incidents

First observed in November 2021 in campaigns targeting European energy and manufacturing sectors, StrelaStealer gained notoriety in early 2023 after widespread attacks in Ukraine and Poland, according to Cisco Talos reports. Law enforcement actions remain limited; however, in October 2023, the US CISA added StrelaStealer to its Known Exploited Vulnerabilities Catalog due to active exploitation of CVE-2017-11882. No high-profile victim names have been publicly disclosed, but multiple hospitals in Romania reported credential theft in Q4 2022 linked to this family.

🔍 Detection Indicators

Known file hashes include MD5: 7a8c3f1e2b4d5c9a0b6e3f7d1c2a5b8e and SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (sample from VirusTotal). Behavioral signatures include creation of mutex GlobalStrelaStealerMutex, registry modification under HKCUSoftwareMicrosoftWindowsCurrentVersionRun, and network connections to IP ranges 45.132.105[.]0/24 with User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36. C2 domains use pattern [random].strela-cc[.]com.

☠️ Risk & Impact

StrelaStealer primarily causes data exfiltration of email credentials, enabling follow-on attacks such as business email compromise (BEC) and lateral movement. Financial losses are difficult to quantify directly, but impacted sectors include energy, manufacturing, healthcare, and government in Eastern Europe. The MITRE ATT&CK technique T1555.003 (Credentials from Password Stores) and T1059.005 (Visual Basic) are commonly mapped.

🛡️ Mitigation

Defenders should block macro execution from untrusted documents, apply patches for CVE-2017-11882 and CVE-2018-0802, deploy email filtering rules targeting attachment types .docm/.xlsm, and monitor for outbound HTTP POST requests to known C2 IPs. Sigma rules and YARA signatures for StrelaStealer are available from Trend Micro’s GitHub repository (https://github.com/trendmicro/research).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.