{
  "family": "oepass",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nOEPass is a specialized Information Stealer and HackTool explicitly designed to target and extract saved passwords from Microsoft Outlook Express and Windows Mail. While Outlook Express is a legacy email client, OEPass remains a relevant threat in environments maintaining older infrastructure, and its underlying techniques have been incorporated into modern credential harvesters.\n\n<h3>Technical Architecture and Exploitation</h3>\nOEPass is typically distributed as a standalone utility, often dropped by a primary downloader Trojan or utilized directly by an attacker who has gained interactive access to a compromised host.\n\nIts core functionalities rely on exploiting the way legacy Windows systems stored credentials:\n<ul>\n<li><strong>Registry Extraction:</strong> OEPass queries specific registry keys associated with Outlook Express profiles (e.g., `HKCU\\Identities\\{Identity-ID}\\Software\\Microsoft\\Internet Account Manager\\Accounts`).</li>\n<li><strong>Protected Storage API:</strong> It interacts with the legacy Windows Protected Storage (PStore) API, extracting the encrypted email account credentials (POP3/SMTP/IMAP).</li>\n<li><strong>Decryption and Exfiltration:</strong> OEPass decrypts the stored passwords locally and formats them into a readable text file. Modern variants of the malware will then automatically exfiltrate this file to a remote command-and-control (C2) server via HTTP or FTP.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe successful execution of OEPass leads directly to email account compromise. Attackers utilize these stolen credentials to launch Business Email Compromise (BEC) attacks, distribute internal phishing emails, and access sensitive corporate communications.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Deprecate Legacy Software:</strong> The most effective defense against OEPass is the complete removal of unsupported, legacy email clients like Outlook Express from the corporate environment, migrating users to modern platforms (like Outlook 365) that utilize robust, centralized authentication (OAuth).</li>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Deploy EDR solutions tuned to alert on processes attempting to access sensitive PStore APIs or querying specific legacy registry keys associated with email profiles.</li>\n<li><strong>Credential Auditing:</strong> If OEPass is detected, mandate an immediate password reset for the affected user's email accounts, as the credentials must be considered fully compromised.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HackTool.OEPass",
    "PasswordStealer.OEPass",
    "Riskware.OEPass"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555.003",
    "T1003",
    "T1048"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:31:29Z",
  "type": "InfoStealer",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}