e316bcbc23b913fda00c8a16abe284052d9caa067effdd2c152661e98701abd3

Sharing

Copy URL Twitter E-mail

General

Target
Cheat Engine 7.5.zip
Size 49.5MB
Sample260621-aesmesbt9w
SHA256 e316bcbc23b913fda00c8a16abe284052d9caa067effdd2c152661e98701abd3
MD5 fbc6514153e7b56311c6f09ffb46f1ef
SHA1 bd713ae57788ab0c7d6c99594ff85dae84536185
SHA512 e8e356fb159ef2634f357510c73d787e432e83b96dfd05e9d4af11dfcfab76bbd83f17acea2e3058de87f59f648ac9c76c181bbcc50184066d859ac0c6df086e
SSDEEP 1572864:K+7UaoK30nPYxE0FKcLUPdZR0IQg1NB4GO:xn3cYeSZUoIQg1NJO
TLSH
T1B6B7337980586A6CCF0F1B316D525D3EECF046A6A5B3CDE9B8C1F4C01F52993B9A98C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Cheat Engine 7.5/bin/CED3D10Hook.dll
- Size 128KB
- SHA256 148f12445f11a50efbd23509139bf06a47d453e8514733b5a15868d10cc6e066
- MD5 43dac1f3ca6b48263029b348111e3255
- SHA1 9e399fddc2a256292a07b5c3a16b1c8bdd8da5c1
- SHA512 6e77a429923b503fc08895995eb8817e36145169c2937dacc2da92b846f45101846e98191aeb4f0f2f13fff05d0836aa658f505a04208188278718166c5e3032
- SSDEEP 1536:jRXPVJPMo10+PfXl/IRTlsfQstLh66crJWeWyPCUpfrCWV13P1+CUOEvCvOEMI7:BdJPMlMb1g6e0dU9rf3P7UObvOja
- TLSH
  T119D39E127620C072CA4A597D8096C7726FBAA6719BDC40C7FB661B3D9F203D16B7930A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Cheat Engine 7.5/bin/CED3D10Hook64.dll
- Size 140KB
- SHA256 a2ac2ba27b0ed9acc3f0ea1bef9909a59169bc2eb16c979ef8e736a784bf2fa4
- MD5 0daf9f07847cceb0f0760bf5d770b8c1
- SHA1 992cc461f67acea58a866a78b6eefb0cbcc3aaa1
- SHA512 b4dda28721de88a372af39d4dfba6e612ce06cc443d6a6d636334865a9f8ca555591fb36d9829b54bc0fb27f486d4f216d50f68e1c2df067439fe8ebbf203b6a
- SSDEEP 3072:Kd3u82FbW5v1B9omLKfBbYWFhFCsfa5z8saPFZ1sL3OD1Ow:Kd+NFbWUMKfBTjFxfa5a1y4N
- TLSH
  T1CCE37C5B737540B7C60ADA7DC9C39A47EBB0B0420BA4538F4366865A1F177A0AE2F325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Cheat Engine 7.5/bin/CED3D11Hook.dll
- Size 137KB
- SHA256 1e30126badfffb231a605c6764dd98895208779ef440ea20015ab560263dd288
- MD5 42e2bf4210f8126e3d655218bd2af2e4
- SHA1 78efcb9138eb0c800451cf2bcc10e92a3adf5b72
- SHA512 c985988d0832ce26337f774b160ac369f2957c306a1d82fbbffe87d9062ae5f3af3c1209768cd574182669cd4495dba26b6f1388814c0724a7812218b0b8dc74
- SSDEEP 1536:onOLYqoZQBD3m7bmVLcuVGpGXlWXQznQN8erRxQEmsYOT1GlERbo3iV8n/7DkCWy:o4YqoZNHi7VBAXvXMZ7ll3iyn3WOR3Oc
- TLSH
  T188D38C12B661C433CA4A0C7D809AD7266F7EA6715BE844C7FB5A173D5F203D06B3A31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Cheat Engine 7.5/bin/CED3D11Hook64.dll
- Size 146KB
- SHA256 6f505cc5973687bbda1c2d9ac8a635d333f57c12067c54da7453d9448ab40b8f
- MD5 0eaac872aadc457c87ee995bbf45a9c1
- SHA1 5e9e9b98f40424ad5397fc73c13b882d75499d27
- SHA512 164d1e6ef537d44ac4c0fd90d3c708843a74ac2e08fa2b3f0fdd4a180401210847e0f7bb8ec3056f5dc1d5a54d3239c59fb37914ce7742a4c0eb81578657d24b
- SSDEEP 3072:/20T06lYodB6ZcnHgSFulvfV0tYP/ipaQ8PFRBIiOBNOW:1Y6bdB6uHgSwtfV0+P/is1BIpD
- TLSH
  T12BE36B4773B540B7D606CA7DC9D3A657EBB070450BA5838F4726862A6F233A0AE3F315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Cheat Engine 7.5/bin/autorun/AddToNewGroup.LUA
- Size 1KB
- SHA256 87fa0d759d6b36cba2b5cb0a8c5c3c43312b0ee6f03e077c4ad6b9f748c5f8b0
- MD5 83bdbb1ba0dd3c8c5a18f125951c9325
- SHA1 bd0a80c6bfe473209c04800fd295c0c5505513b0
- SHA512 dc2959e6fb806d8bb617bfd2f8be7d524a8e8d639f842a31b37d5c8ce445634a44df03cf03d9aa2f7a74137d7fa50966e284dbf02d3662fa78f68acd5ebf80b3
- TLSH
  T10F41BF0B5729A53810D58BF1E8D32CD66B11508A498C4966B7ADC28F1FF03AED9B73C4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Cheat Engine 7.5/bin/autorun/DotNetInterface.lua
- Size 19KB
- SHA256 952bc6a8bfd0070566411ee88ca84f5a7f54c452a4e77790c84cb150595a443b
- MD5 1dce4c5122636604f6ef299e5e6d8211
- SHA1 b7149b4539315c699711403d85fc7b7d6943fb9d
- SHA512 705620c3b2a1bac7de12778fe953ed96c956f04b53c944907e00086fec2774b1202d424e6428c9e1daa0d49376a6f03b4de5b33e56c778c02f6cdcd76cb3ebe9
- SSDEEP 192:DmA6x6gnQPYg7Zlzgng7/QgVgigbgggQ/egegmgKXh5XCZ1C1TRxvnW53ZgmdUMg:D6hQ9i27lKmUgQm
- TLSH
  T1B392CF8D76867ED303FA817477860469BA2B504323156BD4BEDD8CD0FB84A3DA0EB794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Cheat Engine 7.5/bin/autorun/alternateSpeedhack.LUA
- Size 7KB
- SHA256 521d2a3aa71c4b7bf8cead6b8995d2fa5f50f4cf69700f70bd6e2f668d376662
- MD5 69b03b6395c4c780fed5091c0b8230c3
- SHA1 b313763b1499d2d1a7e85f3e13e6c251419f1b2d
- SHA512 5148f34e25688a354926bc66fdd0a6415c9cc054cc3533824b4e32d6c63e9b46460326bbf5864f7b42e76d01ad86bc5567ca27c60f24b56e0670b4be9967e515
- SSDEEP 192:kSvFSGEVbBEspx/G9SXFHxaLafs5RJA4Zbp:kNtt0oaLam/
- TLSH
  T162E1760FB15A25B04743F078968314B1160D18835BAC0F7AF5EE81ED7FA875ED4ABB98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Cheat Engine 7.5/bin/autorun/andtools.lua
- Size 7KB
- SHA256 dd4200b4dbcc957930056dc0762f5b4d3b05b84eee48ceb894a71fa4e31b02de
- MD5 73bfd9b978cdc502295ca78d5f22dad7
- SHA1 b6e3bbfc51a789e672638e3cf08a539bd101bcc0
- SHA512 2436822e19e7c11cc3f342197afa8c646a21ad4993ab63f8741eba10486c04a9970328623b80d43092312a4c1479c9783ffb38c7bfed132164c6860c903bf80e
- SSDEEP 192:kr0u5yjRAJgkv4a0vmIVn4vAP9dno/wF+j6IV5yG52:k4uAjRQgg4tmIR8+95WLj952
- TLSH
  T191F14222A3B6263426D74597BACB00024BD718AB012610E27EEDA0D43F3D655D3F7FA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Cheat Engine 7.5/bin/autorun/autosave.LUA
- Size 8KB
- SHA256 2102c2a017fe0c15d924891750f2108734c1f616bb8155db075109e4368a931e
- MD5 005a675ddbdf7e8359aab9af19dd7000
- SHA1 2dc8ef7abbacff7c11bbdc3e7edfe95a9b2ddeea
- SHA512 a756d3f6b4cfd8ac91d30f768f4d4ce3571250f484c6fe00e3e439062cb6a7eeef506799324c97b02e9367482dffb72ca599361a3261e95d203d645ac8bd267b
- SSDEEP 192:77ODPchjfwp0nUubFgqXz/C/cozwzQtHdBLRs6:o90UKXxqXR
- TLSH
  T17F02522ABA07367C6A0943B5A0C749156631214B05139E78F9DFA0803F9177D52FFBF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Cheat Engine 7.5/bin/autorun/babyce.lua
- Size 14KB
- SHA256 1a0af003b24d7af4aac1da4f635dc2654b909ea4e377aa7f8100e1423fe56156
- MD5 2752eb057b40d4490c866315c6f50055
- SHA1 0e228ca74cc7c15922e8fce81067cc0c6630257f
- SHA512 33c3e6493efb708f06ad3ec2f6072cc24a0f62474734a2307347f43bc4a6e669dc03df9d954337c57aff4e3f7e19cefa0d9740390b2e54fc797c8e8f50e27ce9
- SSDEEP 384:aapaXjubrqWBIsICp4vgbWj5fP24uH8pvn1ehUqmWcCGcZhaGNFwytpeuwFda:aawXSbrqWBIsIq4vgbWj5fP24w8pvE+Q
- TLSH
  T18352104630421AF5A8F297BA5A970CC1EB12002369633CAB3C5D95DC4FB8A8B56D53DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Cheat Engine 7.5/bin/autorun/bigendian.lua
- Size 7KB
- SHA256 ec62e56280d04a8abf6bd1261991a505b2e5901082d8e41c9a6a15592cc9ac27
- MD5 4b2ee1e7fcff5281b4f39698d8ca5a16
- SHA1 9f1924319e471a58c6ee765eaa574baa95918b70
- SHA512 32128583eda5100278f94118bf0fc06c5d34a5812693597f90da4c4fa2303ca4a9e5e69d2f60565492532fdeaf9335272e96c4d2c4897559dede12987ff09bd9
- SSDEEP 192:AQMWG73KlI7UQUWi7lKli7GQYWp7G7wDrcHZfBQQRT8Rw+:ANK7DKJPNTm1
- TLSH
  T187F198693E10AAFD070196E769CE4DD71381E4E720E4438834DE58594FB10BF86B77E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Cheat Engine 7.5/bin/autorun/ceshare.lua
- Size 13KB
- SHA256 a825f660df2e6c13dbece0a0f8dc306129bd784f8dc4efc37e67e9cdd00ce65f
- MD5 26c0e56abebfb550a9d208d6191816e0
- SHA1 8f2392846633ac48a0168afe9f20afc124699f4c
- SHA512 4fc8a18e2f24374953694cb9230d9ddba7a1b69b3ba5574ae143cb79b8d0f7cd94e9dd7337ec58ea40769a4b552a583c466781ac7eff50c9199eab39ad2076a9
- SSDEEP 192:p1mEfPL5ThWRM8vLdyWR1hHS+6stplX7ZbaFYBY6tnGb:VfPjylLNkKW6tE
- TLSH
  T1B25292677542A67D94F2CFB5F8E70451F216404362A6482DBACC40463FB278CE9AE7EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Cheat Engine 7.5/bin/autorun/ceshare/ceshare_account.lua
- Size 6KB
- SHA256 0765d83f004386d898aba55a9bb53d032ee38a422b6eef0770e74f7693e7e69b
- MD5 fb24f06295b3181d16c2097ed6dd1747
- SHA1 37d0f0071cba48aab9f2eec7acd2b1f237bb10e6
- SHA512 6699d2f27d41f9c415a7f3300b019a8afe5f3618be9d1a20e4db201b1026abbb2f3a79ce567509590fc43b77516689d5b7b28d7ce41e1db374cf83ec697bc67a
- SSDEEP 192:9mEzdE7OvG9VfHAemV9HmIcqH2E8VHo09CSADseggWXHaOYOKQWnDYW+VwHiPZJz:9mEJvGHo9NruoyFGAo2f
- TLSH
  T16CD1EF37D1254E645B65DAFA34D70845A885D9031300E8BD38ED96443FA3F4E8CEA9FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Cheat Engine 7.5/bin/autorun/ceshare/ceshare_comments.lua
- Size 3KB
- SHA256 67b02bfd7d1351665447d1e6309f66685e762835256e9718bd68f1b0212c059b
- MD5 43c3d935e0ad2cb1df42b20f43a56ad0
- SHA1 a8f4ec68d2bb6235166c54af1afe5bc7859f5d29
- SHA512 47c190dfd1274d44c51ce873125aa482876a43b57208ee8d284638e65b06399fd9dcb120466a99d4aa48e163d074b2ea2c32581aacc80fad42923934f4ecb3e0
- TLSH
  T10881EC7A31E5367C80406FAE3AD3260B66E1132B1105294EB2EC918D7F91F7A64BD3DD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Cheat Engine 7.5/bin/autorun/ceshare/ceshare_fulltablelist.lua
- Size 12KB
- SHA256 d67c3f857954e7c49e94bebf62333378408235b2273234180ec0e16f35d9bedf
- MD5 725139185a5ca226abee128b3e04295e
- SHA1 019ead2182ff6d2394d13e38da2ba0b4a25a4b93
- SHA512 6ea119aa2846362fae22cbb488ad31b95b2698b80b4ca9f1ac7624e7d89e2d9dbee8d3075b1942299df314fc196c4791abb0c3515b72c508f2e3d7c52b209322
- SSDEEP 192:0nXu6OpWQ1urJJrYN3FJ/W1O0f0SjBf25Csy4U5nlFJR05O2xBLWplHWHHApN85+:kEWQ1qnsFrseL+K5rHckVuWG
- TLSH
  T16742486AB61A712CC2C38FFAB4B74E069792E01352851D2DB6DC41493F8139DA4EE7F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Cheat Engine 7.5/bin/autorun/ceshare/ceshare_permissions.lua
- Size 3KB
- SHA256 3ff8fac3d2fb9a00af04787242eded48a16b4cd7fec923ed28d33bf5806f6885
- MD5 d2bc857c62a33e4bf7398e07cd3cb5bc
- SHA1 ac6324ca159b785dca907b2180ad3b6e97dbb097
- SHA512 262e6220340ed18c777efc5dfbd27515c4dc08cf34d106b8b3cfb377542a40a81e285d044fee86db045aea577a8201737f61327f22a59095000f77b157d47bf2
- TLSH
  T1BF715867AA1D13784084CF7634B709C1AE69100331852A3DF6BD12993F5139BAAFABCC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32