strongpity

General

Target
fa68aa01fad37dd7e7d6222ef833ec4e63317c0821a45834dfe284fdafb9069a
Size 7.2MB
Sample220124-c67xjaafaq
SHA256 fa68aa01fad37dd7e7d6222ef833ec4e63317c0821a45834dfe284fdafb9069a
MD5 7560bc4862c99de7d33cd3ae6c93ba8a
SHA1 ec1b474aaf772c85c0714e70f8096825a3b63b12
SHA512 c209e4bde2e6e36e5480edf11ca67a887724fa5b46836ce4fffc1c814f67132ce88f59b46bb3a1861db28943b8df80e8f0606f52ba0918a68f9f2256fbeb7591
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  fa68aa01fad37dd7e7d6222ef833ec4e63317c0821a45834dfe284fdafb9069a
- Size 7.2MB
- SHA256 fa68aa01fad37dd7e7d6222ef833ec4e63317c0821a45834dfe284fdafb9069a
- MD5 7560bc4862c99de7d33cd3ae6c93ba8a
- SHA1 ec1b474aaf772c85c0714e70f8096825a3b63b12
- SHA512 c209e4bde2e6e36e5480edf11ca67a887724fa5b46836ce4fffc1c814f67132ce88f59b46bb3a1861db28943b8df80e8f0606f52ba0918a68f9f2256fbeb7591
- MD5 SHA1 SHA512
Score

10^/10

strongpity xmrig evasion miner spyware stealer suricata
- StrongPity
  StrongPity is a spyware developed by PROMETHIUM APT group mainly used in government sponsored attacks.
  stealer spyware strongpity
- StrongPity Spyware
- suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016 (WinHTTPRequest)
  suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016 (WinHTTPRequest)
  suricata
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Security Software Discovery

1

T1063

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

StrongPity Spyware

suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016 (WinHTTPRequest)

xmrig

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Loads dropped DLL

Checks for any installed AV software in registry

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2