General
-
Target
cheeto.exe
-
Size
4.0MB
-
Sample
240522-embfbsbf8y
-
MD5
cd087a2a47e92558735abd8bb79ed24b
-
SHA1
3ecec38b845b431d95d397b6cf29744bef64c7e7
-
SHA256
881ebd4d6811501eed8abf80b378d63752fd1ba452432bb9734fe1c8e5e2433a
-
SHA512
d12a8775c98a8272f986bece6609a8b578640ce398fb512ae68cb53b79dea40eddf8388b0b8e2a5feab4b59951c69204dd30d90a699663c6f38f314a660d415a
-
SSDEEP
98304:JYJCzVOFyo8s/QekcAxnEI83tSQRipaW9LYTe+a2Xp1G:CCzVODQl/qM6ix9ETbZo
Behavioral task
behavioral1
Sample
cheeto.exe
Resource
win10-20240404-en
Malware Config
Targets
-
-
Target
cheeto.exe
-
Size
4.0MB
-
MD5
cd087a2a47e92558735abd8bb79ed24b
-
SHA1
3ecec38b845b431d95d397b6cf29744bef64c7e7
-
SHA256
881ebd4d6811501eed8abf80b378d63752fd1ba452432bb9734fe1c8e5e2433a
-
SHA512
d12a8775c98a8272f986bece6609a8b578640ce398fb512ae68cb53b79dea40eddf8388b0b8e2a5feab4b59951c69204dd30d90a699663c6f38f314a660d415a
-
SSDEEP
98304:JYJCzVOFyo8s/QekcAxnEI83tSQRipaW9LYTe+a2Xp1G:CCzVODQl/qM6ix9ETbZo
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Sets service image path in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-