General
- Target CHEAT.exe
- Size 15.2MB
- Sample260528-m591lsdv3k
- SHA256 57c4a0f14e9c2f6e519e74b4b07ed2def9eca059422847e003cfc4005b26b1e4
- MD5 acfad33f5aef77aabf9a668e02c4ac8c
- SHA1 d24a57056bf207a4c6dcd0086dc9686faba42c3c
- SHA512 a8429222aed2c3400b7b4f1be50a1161c9b3d0d40e6dd37da52cb687e31f5df26c8f0ed710d4fcc7bd037b3082a18cd53dc8826eba44b1b8003877b22332cd9e
- SSDEEP 393216:085vzMG85W8345n1+TtIiFGvvB5IjWqgau5thoA/WbzvhSfrFlM:35vz65W8mn1QtIZX3ILO5thQhGpl
- TLSH T172F623C32F54CD9CF1918D3C41ECC04567B128EA27A8C7C797650AABAC572929B9EF07
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
CHEAT.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
CHEAT.exe
Resource
win11-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target CHEAT.exe
- Size 15.2MB
- SHA256 57c4a0f14e9c2f6e519e74b4b07ed2def9eca059422847e003cfc4005b26b1e4
- MD5 acfad33f5aef77aabf9a668e02c4ac8c
- SHA1 d24a57056bf207a4c6dcd0086dc9686faba42c3c
- SHA512 a8429222aed2c3400b7b4f1be50a1161c9b3d0d40e6dd37da52cb687e31f5df26c8f0ed710d4fcc7bd037b3082a18cd53dc8826eba44b1b8003877b22332cd9e
- SSDEEP 393216:085vzMG85W8345n1+TtIiFGvvB5IjWqgau5thoA/WbzvhSfrFlM:35vz65W8mn1QtIZX3ILO5thQhGpl
- TLSH T172F623C32F54CD9CF1918D3C41ECC04567B128EA27A8C7C797650AABAC572929B9EF07
- MD5 SHA1 SHA512 SSDEEP TLSH
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Modifies boot configuration data using bcdedit
Drops startup file
Loads dropped DLL
Adds Run key to start application
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1