strongpity

General

Target

fa68aa01fad37dd7e7d6222ef833ec4e63317c0821a45834dfe284fdafb9069a
Size

7.2MB
Sample

220124-c67xjaafaq
MD5

7560bc4862c99de7d33cd3ae6c93ba8a
SHA1

ec1b474aaf772c85c0714e70f8096825a3b63b12
SHA256

fa68aa01fad37dd7e7d6222ef833ec4e63317c0821a45834dfe284fdafb9069a
SHA512

c209e4bde2e6e36e5480edf11ca67a887724fa5b46836ce4fffc1c814f67132ce88f59b46bb3a1861db28943b8df80e8f0606f52ba0918a68f9f2256fbeb7591

Score

10^/10

Malware Config

Targets

- Target
  
  fa68aa01fad37dd7e7d6222ef833ec4e63317c0821a45834dfe284fdafb9069a
- Size
  
  7.2MB
- MD5
  
  7560bc4862c99de7d33cd3ae6c93ba8a
- SHA1
  
  ec1b474aaf772c85c0714e70f8096825a3b63b12
- SHA256
  
  fa68aa01fad37dd7e7d6222ef833ec4e63317c0821a45834dfe284fdafb9069a
- SHA512
  
  c209e4bde2e6e36e5480edf11ca67a887724fa5b46836ce4fffc1c814f67132ce88f59b46bb3a1861db28943b8df80e8f0606f52ba0918a68f9f2256fbeb7591
Score

10^/10

strongpity xmrig evasion miner spyware stealer suricata
- StrongPity
  StrongPity is a spyware developed by PROMETHIUM APT group mainly used in government sponsored attacks.
  stealer spyware strongpity
- StrongPity Spyware
- suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016 (WinHTTPRequest)
  suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016 (WinHTTPRequest)
  suricata
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Security Software Discovery

1

T1063

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

StrongPity Spyware

suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016 (WinHTTPRequest)

xmrig

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Loads dropped DLL

Checks for any installed AV software in registry

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2