Static task
static1
Behavioral task
behavioral1
Sample
1380160229604c7d499372dd8192024451291d8bf54e87f19c9e2077b1f165c6.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
1380160229604c7d499372dd8192024451291d8bf54e87f19c9e2077b1f165c6.exe
Resource
win10-en-20211208
General
-
Target
1380160229604c7d499372dd8192024451291d8bf54e87f19c9e2077b1f165c6
-
Size
119KB
-
MD5
c66279129816fd2986495f5fcfec8625
-
SHA1
44bd7a588f94595b09f41553905dfc0f4e2b564e
-
SHA256
1380160229604c7d499372dd8192024451291d8bf54e87f19c9e2077b1f165c6
-
SHA512
3dbd69e166391f8d9cd4dd1cdfd80c165f44279eef3785c0062b3ad14b0e19e2899c24a3817f179788225569b5bf3d776575ae8f9eeb09ab9d88f82b2dbf2d04
-
SSDEEP
3072:rDZQbE3vSKRppxuq3VkDc2Y2Myb0s46kzMkm:3ZQbEtZlVsUM
Malware Config
Signatures
-
StrongPity Spyware 1 IoCs
Processes:
resource yara_rule sample family_strongpity -
Strongpity family
Files
-
1380160229604c7d499372dd8192024451291d8bf54e87f19c9e2077b1f165c6.exe windows x86
9a49224f4ebb04691e0e0e2c5501f803
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
CreateFileW
GetFileAttributesW
OpenEventW
ExitThread
GetModuleHandleA
SetFileAttributesW
GetLastError
SetEvent
DeleteFileW
CloseHandle
HeapAlloc
GetProcAddress
GetFileSize
TerminateProcess
CreateProcessW
GetTickCount
GetModuleFileNameA
WaitForMultipleObjects
GetVersion
CreateToolhelp32Snapshot
ProcessIdToSessionId
Sleep
Process32NextW
LoadLibraryA
CreateThread
lstrcmpiA
CreateEventA
GetCurrentProcess
FindNextFileW
HeapFree
FindFirstFileW
ReadFile
GetProcessHeap
CreateDirectoryW
DecodePointer
EncodePointer
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
GetStringTypeW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RaiseException
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapReAlloc
GetFileType
CompareStringW
LCMapStringW
FindFirstFileExA
WriteConsoleW
advapi32
CreateServiceA
SetServiceStatus
ChangeServiceConfig2W
OpenSCManagerA
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
shell32
SHGetFolderPathW
shlwapi
PathFindFileNameW
winhttp
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpQueryOption
WinHttpConnect
WinHttpCrackUrl
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpReceiveResponse
WinHttpWriteData
Sections
.text Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ