Overview

overview

9

Static

static

7

cheeto.exe

windows11-21h2-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    cheeto.exe

  • Size

    4.0MB

  • Sample

    240225-n7atzaba33

  • MD5

    1d9d9eb4caf4a92c2f2f1bd44ab1b695

  • SHA1

    d61006c87b7b567566e1c06f2cad209380ff70be

  • SHA256

    d5bd2d1990de46d98907c10c535cfe81ed10a9682fac36e089946ccc14ce3e0c

  • SHA512

    558d7ec35fb8480917a8a37b8e9aef44a5cb58be0c1842be8d9f6224250273a7c6f9f4d64306a38630d76ecd5533bec4cc5115c7e320495087fc91109f5e5093

  • SSDEEP

    98304:3VAyZVmCs9rhcw3M//OfYts2SsJXkn7IG/HPiduYf:uyZVmCs9rhlSm0siJdeJE

Score
9/10
evasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      cheeto.exe

    • Size

      4.0MB

    • MD5

      1d9d9eb4caf4a92c2f2f1bd44ab1b695

    • SHA1

      d61006c87b7b567566e1c06f2cad209380ff70be

    • SHA256

      d5bd2d1990de46d98907c10c535cfe81ed10a9682fac36e089946ccc14ce3e0c

    • SHA512

      558d7ec35fb8480917a8a37b8e9aef44a5cb58be0c1842be8d9f6224250273a7c6f9f4d64306a38630d76ecd5533bec4cc5115c7e320495087fc91109f5e5093

    • SSDEEP

      98304:3VAyZVmCs9rhcw3M//OfYts2SsJXkn7IG/HPiduYf:uyZVmCs9rhlSm0siJdeJE

    Score
    9/10
    evasionpersistencethemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Sets service image path in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks