Talos Promethium June 2020

StrongPity can identify the IP address of a compromised host.

StrongPity can automatically exfiltrate collected documents to the C2 server.

StrongPity has used encrypted strings in its dropper component.

StrongPity has named services to appear legitimate.

PROMETHIUM has named services to appear legitimate.

PROMETHIUM has disguised malicious installer files by bundling them with legitimate software installers.

StrongPity has been bundled with legitimate software installation files for disguise.

StrongPity can exfiltrate collected documents through C2 channels.

StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.

StrongPity can use PowerShell to add files to the Windows Defender exclusions list.

StrongPity can delete previously exfiltrated files from the compromised host.

StrongPity can use HTTP and HTTPS in C2 communications.

StrongPity can parse the hard drive on a compromised host to identify specific file extensions.

PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.

StrongPity has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.

StrongPity can identify if ESET or BitDefender antivirus are installed before dropping its payload.

StrongPity has created new services and modified existing services for persistence.

StrongPity can use the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key for persistence.

PROMETHIUM has used Registry run keys to establish persistence.

StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme.

StrongPity has the ability to hide the console window for its document search module from the user.

StrongPity can install a service to execute itself as a service.

StrongPity has encrypted C2 traffic using SSL/TLS.

PROMETHIUM has created self-signed digital certificates for use in HTTPS C2 traffic.

StrongPity can identify the hard disk volume serial number on a compromised host.

StrongPity can add directories used by the malware to the Windows Defender exclusions list to prevent detection.