地区

亚洲

中东

StrongPity

初始载荷

Exfiltrate模块（全版本）

import "pe"
rule APT_StrongPity_Exfiltrate
{
    meta:
        author = "建瓯最坏"
        description = "写于2020-12-25，StrongPity，Exfiltrate模块，联网插件"
        V16 = "90B4DF284BD28909047D179F7A0A3391"
        V20 = "C5CBD6A7DE703AB24C7AAE8D3B0BF38F"
        V21 = "ACD4A1BFD4F08DD799B09496CDA32AF3"
        V22 = "81390CE601D34F384BFF9198EEF793A9"
    strings:
        //版本号标识，格式如"v33_kt33p3"
        $HexVerNumV = { 6A 76 }
        $HexVerNumUnderscore = { 6A 5F }
        $HexVerNumK = { 6A 6B }
        $HexVerNumP = { 6A 70 }
        $StringsName = "name=%ls" nocase
        $StringsDel = "delete=" nocase
        //有些版本SFT字符串被加密处理了，无法通用
        //$StringsSFT = "*.sft" nocase wide
    condition:
        all of them
        and ( @HexVerNumUnderscore[1] - @HexVerNumV[1] <= 0x33 )
        and pe.imports("Kernel32.dll","ReadFile")
        and pe.imports("Kernel32.dll","CreateProcessW")
        and pe.imports("WinHTTP.dll","WinHttpSendRequest")
        //早期版本（V16）导入表没有，通过GetProcAddress获得
        //and pe.imports("Kernel32.dll","GetVolumeInformationW")
}

未知