Infostealer
StrelaStealer
According to PCRisk, StrelaStealer seeks to extract email account log-in credentials.
StrelaStealer is a Windows infostealer.
Background
PCRisk reports that StrelaStealer is built to lift email account log-in credentials, focusing at the time of writing on the Microsoft Outlook and Mozilla Thunderbird clients.
Once it lands on a system, the stealer looks for "logins.json" (account/password) and "key4.db" (password database) inside the "%APPDATA%\Thunderbird\Profiles" directory, which lets it grab Thunderbird credentials.
When Outlook is the target instead, StrelaStealer reads the Windows Registry to obtain the program's key along with the "IMAP User", "IMAP Server", and "IMAP Password" values. Because the password is stored encrypted, the malware calls the Windows CryptUnprotectData function to decrypt it before sending it out.
Source: Malpedia (Fraunhofer FKIE).