Data by Hatching Triage Windows

StrelaStealer

StrelaStealer, also known as Strela, is a Windows infostealer focused on harvesting email account data from desktop mail clients.

Profile source: Mallory

StrelaStealer

Family profile

StrelaStealer, also known as Strela, is a Windows infostealer focused on harvesting email account data from desktop mail clients. Active since at least late 2022, it targets Microsoft Outlook and Mozilla Thunderbird by extracting stored IMAP-related credentials and related mailbox access data. On Outlook systems it enumerates profile data in the Windows Registry to recover account configuration and passwords; on Thunderbird systems it searches profile storage for credential databases and login data. Reported variants have also collected email data from infected hosts and transmitted the stolen information to attacker-controlled command-and-control infrastructure over HTTP POST, with request contents protected using a hard-coded XOR-based scheme.

The malware has been distributed through spearphishing and malspam campaigns, including archive attachments that deliver a JavaScript-based loader. Observed infection chains rely on user execution, after which the script launches native Windows utilities and PowerShell to retrieve and execute the payload. Some campaigns have used remote DLL execution through living-off-the-land binaries, while StrelaStealer payloads have also been deployed via DLL sideloading with renamed legitimate executables. Samples have used tailored lure filenames and Spanish-language decoy messaging, indicating social-engineering tradecraft aimed at convincing victims that a malicious file failed to open normally.

StrelaStealer incorporates multiple defense-evasion measures. Observed loaders and payloads use heavy obfuscation, including junk code, string manipulation, control-flow obfuscation, and oversized mathematical instruction blocks intended to frustrate static analysis and sandboxing. Some variants have also been signed with valid code-signing certificates. Development over time has included both DLL and PE forms as well as 32-bit and 64-bit builds.

The malware’s operational purpose is credential theft and exfiltration, particularly against organizations and users whose email access can enable follow-on compromise, account takeover, or intelligence collection. Available reporting indicates a recurring focus on Spanish-speaking victims in early observed campaigns.

Capabilities

Credential Theft
Defense Evasion
Dll Sideloading
Exfiltration
Initial Access

Observed infrastructure

Last seven days

First activity: Aug 26, 2026
Last activity: Aug 26, 2026
Feed role: Distribution
Host form: 0 IP / 1 hostnames

Leading locations

Leading providers

Amazon.com, Inc.1

Infrastructure traits

Hosting 1

MITRE ATT&CK

StrelaStealer in ATT&CK

42 distinct techniques

Techniques

42 techniques

T1555 Credentials from Password Stores T1552.002 Credentials in Registry T1041 Exfiltration Over C2 Channel T1048 Exfiltration Over Alternative Protocol T1204 User Execution T1059.003 Windows Command Shell T1566 Phishing T1497.003 Time Based Checks T1027 Obfuscated Files or Information T1218.011 Rundll32 T1555.003 Credentials from Web Browsers T1059.001 PowerShell T1566.001 Spearphishing Attachment T1059.007 JavaScript T1036 Masquerading T1218.010 Regsvr32 T1218 System Binary Proxy Execution T1140 Deobfuscate/Decode Files or Information T1071.001 Web Protocols T1119 Automated Collection T1082 System Information Discovery T1204.002 Malicious File T1553.002 Code Signing T1614.001 System Language Discovery T1518 Software Discovery T1036.008 Masquerade File Type T1497 Virtualization/Sandbox Evasion T1132.001 Standard Encoding T1480.002 Mutual Exclusion T1480 Execution Guardrails T1105 Ingress Tool Transfer T1027.015 Compression T1020 Automated Exfiltration T1027.013 Encrypted/Encoded File T1574.001 DLL T1001 Data Obfuscation T1027.016 Junk Code Insertion T1552.001 Credentials In Files T1036.005 Match Legitimate Resource Name or Location T1027.002 Software Packing T1036.003 Rename Legitimate Utilities T1622 Debugger Evasion

Reporting

Research mentioning StrelaStealer

Aug 15

Github Web

GitHub - tjnel/certgraveyard_yara: Automated YARA rule generation from the Cert Central compromised certificate database. · GitHub

A public project called CertGraveyard has expanded efforts to document abused code-signing certificates used to sign malware, building a shared record of certificate abuse and helping defenders trigger revocations with certificate authorities. The project’s creator said the initiative grew out of years of reporting malicious certificates tied to malware such as SolarMarker, and has helped report more than 2,000 certificates, later growing to roughly 2,400 entries in the database. Supporting tooling includes certReport, which automates abuse reports from malware hashes using sources such as VirusTotal and MalwareBazaar, plus an API, downloadable datasets, feeds, hunting queries, and integrations with platforms including MalwareBazaar, UnpacMe, Malcat, MagicSword.io, and WDAC enforcement workflows. The database reflects a broader pattern in which threat actors repeatedly obtain or abuse valid Authenticode certificates to make malware appear trustworthy, reduce Windows warnings, and sustain delivery campaigns. Prior reporting cited SolarMarker cycling through impostor-issued certificates, FakeBat distributing signed MSI and MSIX installers, Netbounce using valid certificates and fake software branding, Dark Caracal signing Bandook variants with legitimate certificates, and Operation Red Signature abusing a stolen vendor certificate in a supply-chain intrusion. CertGraveyard’s operator said certificate authorities often act on external reports within hours, making revocation a practical disruption measure, though the project has also faced operational pressure including a major DDoS attack while handling heavy daily lookup and download volumes from defenders and malware-analysis integrations.

Aug 11

Lazarusholic Bluesky

Post by @lazarusholic.bsky.social - Bluesky

A Sonatype report identified six malicious npm packages that used Ethereum transactions to retrieve and stage malicious payloads, an unusual delivery method that obscures second-stage infrastructure behind blockchain activity. The campaign was linked in public reporting to ContagiousInterview and NullReceiver, indicating continued abuse of the JavaScript and Node.js ecosystem for software supply-chain compromise. The activity aligns with broader attacker tradecraft documented for MITRE ATT&CK T1059.007 (Command and Scripting Interpreter: JavaScript), which covers JavaScript and Node.js use for payload delivery, execution, reconnaissance, and command-and-control. Defenders monitoring follow-on behavior should watch for suspicious child-process activity and discovery commands launched from non-shell parent processes, a pattern reflected in Splunk detection guidance for tools such as ipconfig.exe, systeminfo.exe, net.exe, and whoami.exe executed outside normal cmd.exe or PowerShell chains.

Jul 28

Sekoia