StrelaStealer: Forensic Reverse-Engineering & Architectural Dossier

{
  "compiler": "MSVC v14.0+ (x86/x64) compiling native DLL payloads",
  "runtime": "Native Win32 C runtime (MSVCRT.dll); interacts directly with Windows API and Mozilla NSS runtime",
  "binary_footprint": "Single native DLL / EXE, 40 KB - 120 KB native C build (or ~15 MB legacy PyInstaller bundle)",
  "stub_size": "57,344 bytes (native x64 DLL build)",
  "packer_obfuscation": "Delivered via weaponized email attachments (ISO, ZIP, polyglot LNK files, HTML smuggling) executing DLL exports via rundll32.exe",
  "subsystem": "Windows GUI (Subsystem 2)",
  "entry_point_flow": "DllMain / Export Function -> Verify Environment -> Locate Microsoft Outlook Registry Keys -> Enumerate Email Account Subkeys -> Extract Encrypted Passwords -> Call DPAPI CryptUnprotectData to Decrypt Credentials -> Locate Mozilla Thunderbird Profile Directory (logins.json, key4.db) -> Dynamically Load nss3.dll -> Call NSS_Init and PK11SDR_Decrypt -> Parse Plaintext IMAP/POP3/SMTP Passwords -> Format Exfiltration Payload -> Initiate Direct HTTP POST to Compromised C2 Host -> Call ExitProcess(0)",
  "technical_summary": "StrelaStealer is a specialized credential harvester engineered exclusively to steal enterprise email account passwords from Microsoft Outlook and Mozilla Thunderbird. Transitioning from early Python prototypes to optimized, compact native C dynamic link libraries (DLLs), StrelaStealer executes with singular focus. It queries the Windows Registry to identify Outlook configuration profiles, extracting binary-encoded POP3, IMAP, and SMTP authentication passwords and decrypting them in-memory using DPAPI (CryptUnprotectData). For Thunderbird, it parses logins.json, dynamically links to nss3.dll from the Thunderbird installation directory, and invokes PK11SDR_Decrypt to decrypt the mail credentials. Extracted credentials are immediately uploaded via an HTTP POST request to a compromised server, after which the process terminates without establishing persistence."
}

{
  "interface_type": "Compromised Web Server Listener / Log Collection Script",
  "builder_tabs_options": [
    {
      "tab": "Listener Configuration",
      "options": [
        "Compromised Gate Path: PHP receiver script URL (e.g., /wp-content/plugins/.../server.php)",
        "Target Client Filter: Outlook Only, Thunderbird Only, Both Clients",
        "User-Agent Spoofing: Standard browser user-agent string"
      ]
    },
    {
      "tab": "Exfiltration Log Viewer",
      "options": [
        "Credential Tally: Real-time table of incoming email logins",
        "Mail Server Grouping: Grouping by target server domain (Exchange, Office365, Zimbra, cPanel)",
        "Export: CSV / JSON dump formatted for automated BEC credential stuffing"
      ]
    }
  ],
  "config_struct_layout": [
    {
      "offset": "0x000",
      "field": "C2_URL",
      "type": "CHAR[256]",
      "description": "HTTP POST receiver gate URL"
    },
    {
      "offset": "0x100",
      "field": "OutlookKeyPath",
      "type": "CHAR[128]",
      "description": "Registry key path for Outlook profiles"
    },
    {
      "offset": "0x180",
      "field": "ThunderbirdPath",
      "type": "CHAR[64]",
      "description": "AppData subpath for Thunderbird profiles"
    },
    {
      "offset": "0x1C0",
      "field": "TargetFlags",
      "type": "DWORD",
      "description": "Bitmask for targeting Outlook (0x01) and Thunderbird (0x02)"
    }
  ],
  "payload_generation_flags": [
    "Export function specification (strela, Run, DllRegisterServer)",
    "Dynamic runtime linkage to nss3.dll vs. static module inclusion",
    "Payload container generation (ISO mounting scripts / polyglot LNK builders)"
  ],
  "operator_commands": [
    "Non-interactive tool; zero operator runtime command loop",
    "Executes on target host, performs extraction, exfiltrates data, and terminates"
  ],
  "interface_telemetry_analysis": "The operator interface consists of lightweight PHP collection scripts hosted on compromised WordPress or Apache web servers that log extracted email credentials into flat files or databases for subsequent Business Email Compromise (BEC) campaigns."
}

struct StrelaStealer_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

{
  "injection_chain": "Execution initiated via rundll32.exe invoking custom DLL exports (e.g., rundll32.exe payload.dll,strela) launched from malicious shortcut files (.lnk) packaged within mounted ISO disk images.",
  "ntapi_functions": [
    "advapi32!RegOpenKeyExA",
    "advapi32!RegQueryValueExA",
    "advapi32!RegEnumKeyExA",
    "crypt32!CryptUnprotectData",
    "kernel32!LoadLibraryA",
    "kernel32!GetProcAddress",
    "wininet!InternetOpenA",
    "wininet!HttpOpenRequestA",
    "wininet!HttpSendRequestA",
    "kernel32!ExitProcess"
  ],
  "process_hollowing_target": "Direct execution within rundll32.exe process space; no secondary process hollowing required",
  "persistence_mechanics": [
    "No persistence routines implemented",
    "Single-execution one-shot design; immediately exits via ExitProcess(0) following data transmission"
  ],
  "evasion_hooks": [
    "Minimalist API Footprint: Relies exclusively on core Windows registry and cryptographic APIs",
    "Dynamic NSS3 Loading: Dynamically locates and loads nss3.dll directly from existing Mozilla Thunderbird installation paths (C:\\Program Files\\Mozilla Thunderbird\\nss3.dll), avoiding dropping detectable third-party crypto binaries"
  ],
  "anti_analysis": [
    "Debugger Detection: Calls IsDebuggerPresent to check for active debugging sessions",
    "Execution Environment Validation: Validates presence of Outlook registry entries or Thunderbird directory paths before allocating exfiltration memory buffers"
  ]
}

Concrete technical breakdown of functional modules implemented in the StrelaStealer binary:

{
  "framing": "Standard HTTP POST request using multipart/form-data or application/x-www-form-urlencoded MIME formatting",
  "serialization": "Key-value parameter pairs transmitting extracted email accounts: email=<user>&password=<decrypted_pass>&server=<imap_host>&port=<port>",
  "handshake": "Client establishes direct HTTP/HTTPS connection to compromised web server -> Issues single POST request with harvested email credentials -> Server returns HTTP 200 OK -> Client calls ExitProcess(0)",
  "cryptography": "Plaintext HTTP or TLS-encrypted HTTPS depending on destination compromised host; credential payload is transmitted in plaintext or basic Base64 within POST body",
  "packet_types": [
    {
      "header": "POST /server.php / POST /upload.php",
      "payload": "email=<user>&password=<pass>&server=<host>&type=Outlook|Thunderbird",
      "direction": "Client -> Server"
    },
    {
      "header": "HTTP 200 OK",
      "payload": "OK / Empty response",
      "direction": "Server -> Client"
    }
  ],
  "traffic_signature": "Outbound HTTP/1.1 POST request originated by rundll32.exe containing parameters referencing email client fields ('password=', 'email=', 'server=') directed to compromised web paths."
}

Indicators of compromise and forensic patterns recorded across laboratory triage: