StrongPity

StrongPity can use HTTP and HTTPS in C2 communications.^[2][1]

StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme.^[2][1]

StrongPity can use the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key for persistence.^[2]

StrongPity can use PowerShell to add files to the Windows Defender exclusions list.^[2]

StrongPity has created new services and modified existing services for persistence.^[2]

StrongPity has encrypted C2 traffic using SSL/TLS.^[2]

StrongPity has the ability to hide the console window for its document search module from the user.^[2]

StrongPity can add directories used by the malware to the Windows Defender exclusions list to prevent detection.^[2]

StrongPity can delete previously exfiltrated files from the compromised host.^[2][1]

StrongPity has named services to appear legitimate.^[2][1]

StrongPity has used encrypted strings in its dropper component.^[2][1]

StrongPity can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.^[1]

StrongPity can identify if ESET or BitDefender antivirus are installed before dropping its payload.^[2]

StrongPity has been signed with self-signed certificates.^[1]

StrongPity can install a service to execute itself as a service.^[2][1]

StrongPity has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.^[2][1]