StrongPity

StrongPity can use HTTP and HTTPS in C2 communications.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)

StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)

StrongPity can use the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key for persistence.(Citation: Talos Promethium June 2020)

StrongPity can use PowerShell to add files to the Windows Defender exclusions list.(Citation: Talos Promethium June 2020)

StrongPity has created new services and modified existing services for persistence.(Citation: Talos Promethium June 2020)

StrongPity has encrypted C2 traffic using SSL/TLS.(Citation: Talos Promethium June 2020)

StrongPity has the ability to hide the console window for its document search module from the user.(Citation: Talos Promethium June 2020)

StrongPity can add directories used by the malware to the Windows Defender exclusions list to prevent detection.(Citation: Talos Promethium June 2020)

StrongPity can delete previously exfiltrated files from the compromised host.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)

StrongPity has named services to appear legitimate.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)

StrongPity can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.(Citation: Bitdefender StrongPity June 2020)

StrongPity can identify if ESET or BitDefender antivirus are installed before dropping its payload.(Citation: Talos Promethium June 2020)

StrongPity has been signed with self-signed certificates.(Citation: Bitdefender StrongPity June 2020)

StrongPity can install a service to execute itself as a service.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)

StrongPity has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)