strongpity

General

Target

strong.rar
Size

3.9MB
Sample

210420-ntfwbvbqyn
MD5

46beb4b8d66f7e6f65d3a6b3ed6f281c
SHA1

c3603b9f44951e12d3d78a101b5a02efe51d9343
SHA256

2de28557ea0e115aebade74c985b66ba8a711f519506209aea71f80d72e81f6d
SHA512

b31bd9512099eb42034cf731f4f6a90cd248f6d1d3761c5e8f7f1e28539051d346a2caccf0921231f618ae8d6c1a1dd8a5f6f76abba481fd55b202ecd9888920

Score

10^/10

Malware Config

Targets

- Target
  
  strong/057e27d215f4930469417bfd5fec41b193c85ac9275a1ae5594fcbab68c23ed7
- Size
  
  176KB
- MD5
  
  425f3ef372e789b9843dbb4defac606b
- SHA1
  
  5d2a05c50ce9e8b0381c53a01234899c846a4b0c
- SHA256
  
  057e27d215f4930469417bfd5fec41b193c85ac9275a1ae5594fcbab68c23ed7
- SHA512
  
  8f636c2f9e3262bcb9265de3e267ceebb3d2ab443eaeaa251a0b9cff4ae4fa20b22d79e4f6d097e5928ea597664c96b7ff2c03684eac2458fbfd40b15033fca6
Score

10^/10

strongpity discovery persistence spyware stealer
- Modifies system executable filetype association
  persistence
- Registers COM server for autorun
  persistence
- StrongPity
  StrongPity is a spyware developed by PROMETHIUM APT group mainly used in government sponsored attacks.
  stealer spyware strongpity
- StrongPity Spyware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  
  strong/49888f78b5a0576937daeccd73baed86adb6b16a8b0e5ac519f475c73aec0549
- Size
  
  8.0MB
- MD5
  
  bdc36abd3281828ed833db0f552a8ab7
- SHA1
  
  97505836182d8a9b7ce3a543def7a9417bdc5d52
- SHA256
  
  49888f78b5a0576937daeccd73baed86adb6b16a8b0e5ac519f475c73aec0549
- SHA512
  
  ff9406167669c033f45d4ca80d861370a2f84d31667a5b00b1cd84669606232be18caf6ac8598f1f23d398f3c6830ff98f31251c27a5b772e1f16dc693152e94
Score

10^/10

strongpity persistence spyware stealer discovery
- Modifies system executable filetype association
  persistence
- Registers COM server for autorun
  persistence
- StrongPity
  StrongPity is a spyware developed by PROMETHIUM APT group mainly used in government sponsored attacks.
  stealer spyware strongpity
- StrongPity Spyware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral3 behavioral4