TrojanSpy.Win32.STRELASTEALER.A

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy adds the following processes:

• %comspec% /c start rundll32.exe x.html, s & start x.html

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {Derived from first five letters of Computer Name}{Remainder of Computer Name}

Information Theft

This Trojan Spy steals email account information from the following registry entries:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Office\16.0\Outlook\
Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
{8 Digit Value}}
IMAP Server = {Server/s}

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Office\16.0\Outlook\
Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
IMAP Password
IMAP User = {User/s}

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Office\16.0\Outlook\
Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
{8 Digit Value}
IMAP Password = {Password/s}

Other Details

This Trojan Spy does the following:

• The ISO file contains the folowing to execute its payload:
  • Factura.lnk ← shortcut to execute x.html
  • x.html ← main payload
• It searches for the following files inside %AppData%\Thunderbird\Profiles\{FolderName} to steal email accounts and passwords:
  • logins.json ← accounts and passwords
  • key4.db ← password database
• It connects to certain IP addresses to send and receive information:
  • {BLOCKED}.{BLOCKED}.{BLOCKED}.166
  
  However, as of this writing the said IP addresses are inaccessible.