SYMBOLCOMMON_NAMEaka. SYNONYMS
win.strongpity (Back to overview)

StrongPity

Actor(s): PROMETHIUM, StrongPity


There is no description at this point.

References
2021-12-09Minerva LabsNatalie Zargarov
@online{zargarov:20211209:new:2875937, author = {Natalie Zargarov}, title = {{A new StrongPity variant hides behind Notepad++ installation}}, date = {2021-12-09}, organization = {Minerva Labs}, url = {https://blog.minerva-labs.com/a-new-strongpity-variant-hides-behind-notepad-installation}, language = {English}, urldate = {2021-12-13} } A new StrongPity variant hides behind Notepad++ installation
StrongPity
2021-11-30QianxinRed Raindrop Team
@online{team:20211130:cyberspaces:e8efd82, author = {Red Raindrop Team}, title = {{Cyberspace's Magic Eye: PROMETHIUM Fakes attack activity analysis of NotePads and installation packages}}, date = {2021-11-30}, organization = {Qianxin}, url = {https://mp.weixin.qq.com/s/nQVUkIwkiQTj2pLaNYHeOA}, language = {Chinese}, urldate = {2021-12-07} } Cyberspace's Magic Eye: PROMETHIUM Fakes attack activity analysis of NotePads and installation packages
StrongPity
2021-11-05BlackberryThe BlackBerry Research & Intelligence Team
@online{team:20211105:hunter:3c7bab9, author = {The BlackBerry Research & Intelligence Team}, title = {{Hunter Becomes Hunted: Zebra2104 Hides a Herd of Malware}}, date = {2021-11-05}, organization = {Blackberry}, url = {https://blogs.blackberry.com/en/2021/11/zebra2104}, language = {English}, urldate = {2021-11-08} } Hunter Becomes Hunted: Zebra2104 Hides a Herd of Malware
Cobalt Strike DoppelDridex Mount Locker Phobos StrongPity
2021-05-24Anchored Narratives on Threat Intelligence and GeopoliticsRJM
@online{rjm:20210524:tracking:3da0800, author = {RJM}, title = {{Tracking StrongPity with Yara}}, date = {2021-05-24}, organization = {Anchored Narratives on Threat Intelligence and Geopolitics}, url = {https://anchorednarratives.substack.com/p/tracking-strongpity-with-yara}, language = {English}, urldate = {2021-06-21} } Tracking StrongPity with Yara
StrongPity
2021-04-18Anchored Narratives on Threat Intelligence and GeopoliticsRJM
@online{rjm:20210418:recover:9b9c0a8, author = {RJM}, title = {{Recover your files with StrongPity}}, date = {2021-04-18}, organization = {Anchored Narratives on Threat Intelligence and Geopolitics}, url = {https://anchorednarratives.substack.com/p/recover-your-files-with-strongpity}, language = {English}, urldate = {2021-05-25} } Recover your files with StrongPity
StrongPity
2021-02-28PWC UKPWC UK
@techreport{uk:20210228:cyber:bd780cd, author = {PWC UK}, title = {{Cyber Threats 2020: A Year in Retrospect}}, date = {2021-02-28}, institution = {PWC UK}, url = {https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf}, language = {English}, urldate = {2021-03-04} } Cyber Threats 2020: A Year in Retrospect
elf.wellmess FlowerPower PowGoop 8.t Dropper Agent.BTZ Agent Tesla Appleseed Ave Maria Bankshot BazarBackdoor BLINDINGCAN Chinoxy Conti Cotx RAT Crimson RAT DUSTMAN Emotet FriedEx FunnyDream Hakbit Mailto Maze METALJACK Nefilim Oblique RAT Pay2Key PlugX QakBot REvil Ryuk StoneDrill StrongPity SUNBURST SUPERNOVA TrickBot TurlaRPC Turla SilentMoon WastedLocker WellMess Winnti ZeroCleare
2021-02-01Medium 0xthreatintel0xthreatintel
@online{0xthreatintel:20210201:uncovering:d7b9216, author = {0xthreatintel}, title = {{Uncovering APT-C-41 (StrongPity) Backdoor}}, date = {2021-02-01}, organization = {Medium 0xthreatintel}, url = {https://0xthreatintel.medium.com/uncovering-apt-c-41-strongpity-backdoor-e7f9a7a076f4}, language = {English}, urldate = {2021-02-02} } Uncovering APT-C-41 (StrongPity) Backdoor
StrongPity
2020-12-31cyblecybleinc
@online{cybleinc:20201231:strongpity:bb6ab94, author = {cybleinc}, title = {{StrongPity APT Extends Global Reach with New Infrastructure}}, date = {2020-12-31}, organization = {cyble}, url = {https://cybleinc.com/2020/12/31/strongpity-apt-extends-global-reach-with-new-infrastructure/}, language = {English}, urldate = {2021-01-04} } StrongPity APT Extends Global Reach with New Infrastructure
StrongPity
2020-12-21Cisco TalosJON MUNSHAW
@online{munshaw:20201221:2020:4a88f84, author = {JON MUNSHAW}, title = {{2020: The year in malware}}, date = {2020-12-21}, organization = {Cisco Talos}, url = {https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html}, language = {English}, urldate = {2020-12-26} } 2020: The year in malware
WolfRAT Prometei Poet RAT Agent Tesla Astaroth Ave Maria CRAT Emotet Gozi IndigoDrop JhoneRAT Nanocore RAT NjRAT Oblique RAT SmokeLoader StrongPity WastedLocker Zloader
2020-10-30360Threat Intelligence Center
@online{center:20201030:aptc41:ede60de, author = {Threat Intelligence Center}, title = {{蓝色魔眼(APT-C-41)组织首次针对我国重要机构定向攻击活动披露}}, date = {2020-10-30}, organization = {360}, url = {https://mp.weixin.qq.com/s/5No0TR4ECVPp_Xv4joXEBg}, language = {Chinese}, urldate = {2020-11-02} } 蓝色魔眼(APT-C-41)组织首次针对我国重要机构定向攻击活动披露
StrongPity
2020-06-30BitdefenderLiviu Arsene, Radu Tudorica, Cristina Vatamanu, Alexandru Maximciuc
@techreport{arsene:20200630:strongpity:ed365fb, author = {Liviu Arsene and Radu Tudorica and Cristina Vatamanu and Alexandru Maximciuc}, title = {{StrongPity APT - Revealing Trojanized Tools, Working Hours and Infrastructure}}, date = {2020-06-30}, institution = {Bitdefender}, url = {https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf}, language = {English}, urldate = {2020-06-30} } StrongPity APT - Revealing Trojanized Tools, Working Hours and Infrastructure
StrongPity
2020-06-29Cisco TalosWarren Mercer, Paul Rascagnères, Vitor Ventura
@online{mercer:20200629:promethium:e80cd47, author = {Warren Mercer and Paul Rascagnères and Vitor Ventura}, title = {{PROMETHIUM extends global reach with StrongPity3 APT}}, date = {2020-06-29}, organization = {Cisco Talos}, url = {https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html}, language = {English}, urldate = {2020-06-30} } PROMETHIUM extends global reach with StrongPity3 APT
StrongPity
2018-03-09Bill Marczak, Jakub Dalek, Sarah McKune, Adam Senft, John Scott-Railton, Ron Deibert
@online{marczak:20180309:sandvines:14ef912, author = {Bill Marczak and Jakub Dalek and Sarah McKune and Adam Senft and John Scott-Railton and Ron Deibert}, title = {{Sandvine’s PacketLogic Devices Used to Deploy Government Spyware in Turkey and Redirect Egyptian Users to Affiliate Ads?}}, date = {2018-03-09}, url = {https://citizenlab.ca/2018/03/bad-traffic-sandvines-packetlogic-devices-deploy-government-spyware-turkey-syria/}, language = {English}, urldate = {2020-01-05} } Sandvine’s PacketLogic Devices Used to Deploy Government Spyware in Turkey and Redirect Egyptian Users to Affiliate Ads?
StrongPity
2017-12-08ESET ResearchFilip Kafka
@online{kafka:20171208:strongpity2:116d419, author = {Filip Kafka}, title = {{StrongPity2 spyware replaces FinFisher in MitM campaign – ISP involved?}}, date = {2017-12-08}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2017/12/08/strongpity-like-spyware-replaces-finfisher/}, language = {English}, urldate = {2019-11-14} } StrongPity2 spyware replaces FinFisher in MitM campaign – ISP involved?
StrongPity
2016-10-12Twitter (@PhysicalDrive0)PhysicalDrive0
@online{physicaldrive0:20161012:strongpity:86fba4e, author = {PhysicalDrive0}, title = {{Tweet on StrongPity}}, date = {2016-10-12}, organization = {Twitter (@PhysicalDrive0)}, url = {https://twitter.com/physicaldrive0/status/786293008278970368}, language = {English}, urldate = {2020-01-06} } Tweet on StrongPity
StrongPity
2016-10-03Kaspersky LabsKurt Baumgartner
@online{baumgartner:20161003:strongpity:d4a8c09, author = {Kurt Baumgartner}, title = {{On the StrongPity Waterhole Attacks Targeting Italian and Belgian Encryption Users}}, date = {2016-10-03}, organization = {Kaspersky Labs}, url = {https://securelist.com/blog/research/76147/on-the-strongpity-waterhole-attacks-targeting-italian-and-belgian-encryption-users/}, language = {English}, urldate = {2019-12-20} } On the StrongPity Waterhole Attacks Targeting Italian and Belgian Encryption Users
StrongPity
Yara Rules
[TLP:WHITE] win_strongpity_auto (20211008 | Detects win.strongpity.)
rule win_strongpity_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.strongpity."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.strongpity"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 56 8b7508 f7d1 85f6 }
            // n = 4, score = 300
            //   56                   | push                esi
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]
            //   f7d1                 | not                 ecx
            //   85f6                 | test                esi, esi

        $sequence_1 = { 58 0fb60c85de894100 0fb63485df894100 8bf9 8985a4f8ffff }
            // n = 5, score = 200
            //   58                   | pop                 eax
            //   0fb60c85de894100     | movzx               ecx, byte ptr [eax*4 + 0x4189de]
            //   0fb63485df894100     | movzx               esi, byte ptr [eax*4 + 0x4189df]
            //   8bf9                 | mov                 edi, ecx
            //   8985a4f8ffff         | mov                 dword ptr [ebp - 0x75c], eax

        $sequence_2 = { 8955b0 50 8d45b0 50 68???????? 53 }
            // n = 6, score = 200
            //   8955b0               | mov                 dword ptr [ebp - 0x50], edx
            //   50                   | push                eax
            //   8d45b0               | lea                 eax, dword ptr [ebp - 0x50]
            //   50                   | push                eax
            //   68????????           |                     
            //   53                   | push                ebx

        $sequence_3 = { 50 e8???????? 8365d000 8d4dd0 83c40c 8bd6 e8???????? }
            // n = 7, score = 200
            //   50                   | push                eax
            //   e8????????           |                     
            //   8365d000             | and                 dword ptr [ebp - 0x30], 0
            //   8d4dd0               | lea                 ecx, dword ptr [ebp - 0x30]
            //   83c40c               | add                 esp, 0xc
            //   8bd6                 | mov                 edx, esi
            //   e8????????           |                     

        $sequence_4 = { c7042410270000 ff15???????? e8???????? 8b4c245c 5f }
            // n = 5, score = 200
            //   c7042410270000       | mov                 dword ptr [esp], 0x2710
            //   ff15????????         |                     
            //   e8????????           |                     
            //   8b4c245c             | mov                 ecx, dword ptr [esp + 0x5c]
            //   5f                   | pop                 edi

        $sequence_5 = { 66898d60ffffff 59 66898568ffffff 6689856cffffff 33c0 6a23 }
            // n = 6, score = 200
            //   66898d60ffffff       | mov                 word ptr [ebp - 0xa0], cx
            //   59                   | pop                 ecx
            //   66898568ffffff       | mov                 word ptr [ebp - 0x98], ax
            //   6689856cffffff       | mov                 word ptr [ebp - 0x94], ax
            //   33c0                 | xor                 eax, eax
            //   6a23                 | push                0x23

        $sequence_6 = { f7d8 56 57 8b7d08 }
            // n = 4, score = 200
            //   f7d8                 | neg                 eax
            //   56                   | push                esi
            //   57                   | push                edi
            //   8b7d08               | mov                 edi, dword ptr [ebp + 8]

        $sequence_7 = { 6689459e 668945a6 58 6a24 668945aa }
            // n = 5, score = 200
            //   6689459e             | mov                 word ptr [ebp - 0x62], ax
            //   668945a6             | mov                 word ptr [ebp - 0x5a], ax
            //   58                   | pop                 eax
            //   6a24                 | push                0x24
            //   668945aa             | mov                 word ptr [ebp - 0x56], ax

        $sequence_8 = { 8b13 8b827c870000 55 8baa80870000 }
            // n = 4, score = 100
            //   8b13                 | mov                 edx, dword ptr [ebx]
            //   8b827c870000         | mov                 eax, dword ptr [edx + 0x877c]
            //   55                   | push                ebp
            //   8baa80870000         | mov                 ebp, dword ptr [edx + 0x8780]

        $sequence_9 = { 8b11 8bb228010000 83c40c 85f6 7432 }
            // n = 5, score = 100
            //   8b11                 | mov                 edx, dword ptr [ecx]
            //   8bb228010000         | mov                 esi, dword ptr [edx + 0x128]
            //   83c40c               | add                 esp, 0xc
            //   85f6                 | test                esi, esi
            //   7432                 | je                  0x34

        $sequence_10 = { 8b13 8b8228010000 833800 7417 }
            // n = 4, score = 100
            //   8b13                 | mov                 edx, dword ptr [ebx]
            //   8b8228010000         | mov                 eax, dword ptr [edx + 0x128]
            //   833800               | cmp                 dword ptr [eax], 0
            //   7417                 | je                  0x19

        $sequence_11 = { 8b11 8b02 8906 eb54 }
            // n = 4, score = 100
            //   8b11                 | mov                 edx, dword ptr [ecx]
            //   8b02                 | mov                 eax, dword ptr [edx]
            //   8906                 | mov                 dword ptr [esi], eax
            //   eb54                 | jmp                 0x56

        $sequence_12 = { 8b11 5f 5e 899088870000 8bc5 }
            // n = 5, score = 100
            //   8b11                 | mov                 edx, dword ptr [ecx]
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   899088870000         | mov                 dword ptr [eax + 0x8788], edx
            //   8bc5                 | mov                 eax, ebp

        $sequence_13 = { 8b11 8b442420 52 50 e8???????? 83c408 }
            // n = 6, score = 100
            //   8b11                 | mov                 edx, dword ptr [ecx]
            //   8b442420             | mov                 eax, dword ptr [esp + 0x20]
            //   52                   | push                edx
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c408               | add                 esp, 8

        $sequence_14 = { 8b13 8d86f4050000 898214010000 85ff }
            // n = 4, score = 100
            //   8b13                 | mov                 edx, dword ptr [ebx]
            //   8d86f4050000         | lea                 eax, dword ptr [esi + 0x5f4]
            //   898214010000         | mov                 dword ptr [edx + 0x114], eax
            //   85ff                 | test                edi, edi

    condition:
        7 of them and filesize < 974848
}
Download all Yara Rules