Overview

overview

8

Static

static

8

HaloSparta....0.exe

windows7-x64

8

HaloSparta....0.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac9b8d47a2237577680d04c43c1a7f2d4eac6efa9de961e8e4b0c12f0e0539ec

  • Size

    2.6MB

  • Sample

    221124-l91r3afh27

  • MD5

    c606d0d7c26fac5255d0b93a88f5643b

  • SHA1

    cffad081d8ea18a82c67c163246323e238c3a338

  • SHA256

    ac9b8d47a2237577680d04c43c1a7f2d4eac6efa9de961e8e4b0c12f0e0539ec

  • SHA512

    e2ec36138216ef5d617e7de499ffd383ee4817be6d219ab5cd1e291f47b972b0e34badbbd0fb789000dbf996b652fe72414fbaa49a176d2e2c073e128fea06c1

  • SSDEEP

    49152:/vH1wcRsxG97P1rH1QWpzZ27arV2KwoL6UVqi2ppBW8zofm8jTESylX:3Scex0uWpzZ27aQKwoLhVqjpBW8OSx

Score
8/10
discoveryvmprotect

Malware Config

Targets

    • Target

      HaloSpartanAssault+6Tr-LNG_v1.0/HaloSpartanAssault+6Tr-LNG_v1.0.exe

    • Size

      2.7MB

    • MD5

      2ab538f0a57e341acbe001ccdb61524b

    • SHA1

      e131455a51f9b82a1da767f03d09f6ab26ffedc7

    • SHA256

      91717699ab8f65a110044d792838943e2ca5cceb6fbc773fcbb0ebcda21bd8a4

    • SHA512

      3f006b7cef8a31907adf29d06c6474720a22683a2c83edb3d87914a4b2b0698d8468c349d75c485ecec853c281d3e3d806f9653dfc6c2acb8b9a3bc82b029a82

    • SSDEEP

      49152:7fmNigGQUrVJkEY0D2SDTNHumrZ0CbbBIr5sDQuuyyT4ObH42OW19gP+9hBHd+32:aNitQ/k2SDTPV7JIpuPOrFj1PZdo3ZEd

    Score
    8/10
    vmprotectdiscovery

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks