� P�mKJ�l�1N�U�����~��ޖ��C�����+}���k����_��c�ʋ�k}�J$˪A��:������߭�����SJr�C@[_�|��Z��U��;A�it�ʳ�#�e�-��2��&�x%�A�o�7^6�n��E߇���r~[I��u�$J��Jv�Mj������f݃[&0����m�t0op=�/��9o�&?"A$i�vI�\��ab!�{چ���闙�V�a?n�D����>S,s�� ժ����Nyc�^)q��$ci]jkS�V/ؑƚlM E��� �x���z`����g_P�3δ������#�=� [PY�b<�sw�:�֗]H�NZh�x�h-�����TH�7� 9Z���J��I��v��+��eqlq�GB��������4p�����|�&���y8� �Ʊ"� �I��γ���3bL������B�����W�� ����'��p'������� ���s0���>��=kee�!^�{�S,Y]~�;)I ��1ޜ]Qԍ-`�G��ry��xXD�'Q�u�kJ)�~e}f�����o�6#a� �g(#���)�U��!I@���"�����x��X��X����)^X0i�2�< c ��J'���q���Ưs+/3�r;X ��Z_u�\Ԍ�4�x >2�@"E@�͎]tG.c]�1�'���<H� �P���u����G���Y�lCD�u���n�N���0��}���v;k3�dZ�)�BxC����w�q�����%�vRK����u�D�Y1&�v���Q;2�ڮ�c�����mW3�s�(IoFf�����&T+�Deq��ֺ���+�}t�RK<����~���M���т=����f���X�8 ���s�:cɅ0��|��J����_���W� dH�S>��@���yl\7l����qR�k�@�ݷay�)0����e��#�;�<�Cº#+]k�9����<>Ř{c������5���k�M�CT�,HJ���]�NZ�X�\��j���K��%BK�(�]]��L��1��� ���h�}�/��.������LĘ y�h��;�dW0t�'W�bG�<�LH���������:e�������%^LV�E���� k���N���.Z�� )ygֿ/7z$�� b*�l`��M8`���D�?�7lӉ7��f���+)�:�B�;.�r���5��\�N��tދ�ꄼ�D^;C��ǩN�����N}�]�8���~4�;( m�=+�;<��7��}٠��Z.�9�U*WSY���R4?#�H�0���������y�?2����s2���T�(�SۦM�o��z���2w|�<��x:tǚXu��ך{�° |K[��%��-�,>� �gq��O�^[�o��^j�}D/:����?@�x���"5�q4�N��e��X/��;{8�1�eժa�Lke@���1�4�1D�ldi�T�ꡉ����B��� .����,�'8Rv�3�No����*C�!�k��>��E��T}��!��~��Ec��1��xݩ�Hj 3 �WL�e%e��e���!�01�%�y�F<F�2`��zn5:z��b�W���l�]�����|c ����~��!g=�<1���'��*UI�pL�)��n.f�!�[�{���8��YyVz.撚����2��閺�{�I���:�ޅ*O��NC�Y M�oy�*$�5�z��9nV��x��K�ͪ�!�n�S���#�]�=�������2��9�����h������D�)�������w��9S�_kF)��Wu>���6�`&S���3�ot ��9�k�������ج�b�;�D}�Nh�z�h�Vh���`���kW�w��������Z���3�.|?>D��7�qZ�́�Q�lk )�����A8)��� ������~���������MG��z��`d3���':���#1��R�1���kGGE/;�u+�{Zg�#{#A�tu���r��P�Ey�^I�ޥ�\��2JpV�[^�ya�e�\�����m��F����� E�����$Ö$��a���X�ɸ(4ف�C=:v����Y����E���]d/Zǡ�$g�s(��2�[N̠ �~<,���'qp�����,z�N��h����U�e�A`c¨�[��U�6lX�ij�c�����O��;��79s�����Eo�&NpKE8�Z[s.��B>߉�6ð7�\�kc�㰋�X���H����Z�x�p'r3���ܙ2TF<�H%������;0�����jmIh������/��u��E���ޒTF�����n����z$g�{S#����1����C��U�T�L��VҮ��>1N��b����Z��6�IL��G4�� ���N�����FW�F;D5*V҈��'�G��Ӕ< i���%�Ͷ��c���S��pE��Dt/d�3�0�צ���� �3@��us�TlO���c��d��w�P���v:�� �g�l���Y�x��?����_4�L�A��l�����}��f�xlaC�"����J#��6 ���@��^��Lhk�`�1�s(u͝���L���� y�{ �~��@p�Q��ι4P����g9X{���vf�Xiuyܘ|w�u'AƾB����[��N��h�a$�C�~]G����1byn�~��H�\�P��D�\��e�u:-���I�1��Y���db�Y��Hb�r�=��Q�V��O�Ymh�:J�^�q��x7���ְ >]H�Yh#-��p����~A�s�df��J� -l���Z�6�ш���5Cb96�GRh���]�S��#�$A�O�"{�K+��QƘ�Dޞp?_�D!��m�Y�4���K_���.w ��(Fr>�B)v��'8�,c�`vpr맥����DDP�a��ǼJ�LMVr�fE��-\f1��&&�דِ>Ν����mM�`�q+N���H4/us�0ܨ8������[)x����p&�gbJ���V/�Z~B?���Mj�-��1#�R�8�ꄀGv���ð�t{�#�k襁N�+���p~_<5=$G�Ѝ�&�F�ӤNY�������dnPO'���Dȕ��r�L��C�oך1OV��������}��%S�U����?'�.��a;o��xT2]�J\%� �w�a���6�r����-�F�( H���$~ ���Us����=I>N����T=�<-�e�v�fU�kK��RO1��z����$����X�rk?�ۉ�a<�����踈�.)�3�d��{T���n��5.���&ԭh�{ �Sa�lv�D�&j�<3�T�%4�ʀ��$
Static task
static1
Behavioral task
behavioral1
Sample
Cheto Updated.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Cheto Updated.exe
Resource
win10v2004-20220812-en
General
-
Target
Cheto Updated.exe
-
Size
4.8MB
-
MD5
dd6c66d5250437db33b821f5d2c90aa2
-
SHA1
b3be3c2a7455d89cfec2fdbaf93a9f8ebcf4a406
-
SHA256
2e0f2a82868cc31985e9b8c022f852919033c666382aaa3026c456b9c449db3d
-
SHA512
98583056619c30c732889959a69a50e43553f745193e9da5ac8b8c84b1457d7019868dd62f64060bada9392b60cbd3a4e09af54ae8380fa8388a7e561a4625da
-
SSDEEP
98304:Kmz0W3de75qz67ThdyKBj/rhLdaH+Cn5S4YztVm5BppzAaWMr:dzz3detq23hIKBzVxGA4Y3sBTzWMr
Malware Config
Signatures
Files
-
Cheto Updated.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 2.6MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 193KB - Virtual size: 7.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE