d52f85: 2fb095b1 — CS2 external cheat "Cheetah" dropped by Amadey

PE32+ x64 console binary (4.6 MB) built May 2026 as a Counter-Strike 2 external cheat overlay using Dear ImGui. OpenCTI co-labels it dropped-by-amadey, meaning the Amadey downloader botnet delivered it to victims — not that the binary itself is a dropper. The family d52f85 is an OpenCTI opaque label covering Amadey-delivered game-cheats and commodity payloads. ^[file.txt] ^[triage.json]

What It Is

The d52f85 label is the first Amadey-delivered game-cheat observed in this corpus. It is distinct from the 9d2ca3 Amadey cluster (MinGW droppers + Go infostealers + .NET hollowing dropper) ^9d2ca3; this sample is a MSVC-built external overlay, not a second-stage loader. The label is therefore best understood as a distribution-channel grouping, not an intrinsic malware family.

How It Works

The binary is an external cheat for Counter-Strike 2. It runs as a separate Windows process, uses NtReadVirtualMemory/NtWriteVirtualMemory to patch game state in client.dll, and renders an ImGui overlay on top of the game window. This is a classic external trainer/hack architecture — no DLL injection into the game process, no reflective loading, just raw cross-process memory access via the native API.

Key features exposed through ImGui menu strings:

• Aimbot with FOV circle, smoothness, prediction, retarget delay, and bone priority (aimbones) ^[strings.txt:3721]
• Triggerbot with magnet FOV and re-aim delay ^[strings.txt:3723]
• ESP (team/visibility-filtered player highlighting) ^[strings.txt:3807]
• Radar mini-map overlay ^[strings.txt:3931]
• Chams (wireframe / fill / rim-light wall-hack rendering) with occlusion variants ^[strings.txt:994]
• Recoil Control System (RCS) with configurable power ^[strings.txt:3802]
• Velocity / bunny-hop assistance ^[strings.txt:4014]

Game-state resolution uses client_dll.json schema offsets loaded at runtime ^[strings.txt:3048]. The cheat reads standard CS2 entity fields (m_iHealth, m_iTeamNum, m_vecAbsVelocity, m_flRecoilIndex, etc.) ^[strings.txt:3011] and writes back m_flFlashOverlayAlpha (no-flash hack) ^[strings.txt:2983].

Input injection uses NtUserInjectMouseInput / NtUserInjectKeyboardInput via win32u.dll ^[strings.txt:3270] — a low-level input-synthesis technique that avoids SendInput hooks.

Overlay rendering is via a layered window with SetLayeredWindowAttributes and ImGui backends; the console subsystem is used for debug/logging ^[strings.txt:3656] ^[strings.txt:3658].

Decompiled Behavior

Radare2 analysis (level 3, 2204 functions recovered) shows a standard MSVC C++ entry point at entry0 (0x140112cc4) ^[rabin2-info.txt] ^[r2:entry0]. The entrypoint initializes the UCRT (__initterm_e, _register_thread_local_exe_atexit_callback) and calls main with argc/argv/envp passed through standard C runtime dispatch ^[r2:entry0]. No TLS callbacks are registered (callback array at 0x1401169f8 is NULL-terminated immediately) ^[pefile TLS dump].

No custom export table; no delay-imports. The .text section entropy (6.536) is consistent with compiled C++ and large amounts of ImGui template code ^[pefile.txt]. The .data section entropy (6.667) reflects embedded font bitmaps and ImGui texture atlas data — no encrypted payload detected. No upx, themida, vmprotect, or custom packer signatures in strings or imports ^[strings.txt] ^[yara.txt].

Ghidra was unavailable (pyghidra module not present); decompilation relies on radare2 pdc output.

C2 Infrastructure

None observed. No network URLs, IP addresses, Telegram tokens, Discord webhooks, SMTP endpoints, or C2 domains were recovered in static strings. The binary is entirely self-contained: it loads CS2 memory offsets from a local JSON file (client_dll.json) and operates entirely in-process + cross-process. Any licensing or authentication mechanism is either compiled out or hidden in runtime logic not visible statically. No network imports (WinINet, WinHTTP, WS2_32) are present in the IAT ^[pefile.txt].

This is consistent with a standalone game cheat distributed via a downloader botnet: Amadey delivers the binary; the binary itself needs no C2.

Interesting Tidbits

• PDB leak: The full build path reveals a developer named "nikor" building a project called "cheetah" on their local machine in x64\Release ^[strings.txt:4297]. This is a straightforward opsec failure typical of hobbyist/mod-menu developers.
• Version branding: "Essentials External v1.3" suggests this is a known cheat suite sold or shared in game-cheat communities ^[strings.txt:3720].
• Admin gate: The binary prints "Please run as administrator." if privilege elevation fails ^[strings.txt:3654] — required for NtReadVirtualMemory on protected processes like CS2.
• Schema loader: The client_dll.json runtime offset schema is a modern CS2 cheat technique. The binary reads Source 2 engine schema offsets at startup rather than using hardcoded signatures, making it more resilient to game updates ^[strings.txt:3049].
• No anti-VM/anti-debug: No IsDebuggerPresent, CheckRemoteDebuggerPresent, CPUID hypervisor-bit checks, or VM registry artifacts observed. The binary is a straight cheat overlay, not a stealth implant.
• Font bloat: 3.5+ MB of embedded fonts (Fenix, Montserrat, Orbitron, Noto Serif, Font Awesome) inflate the binary. This is pure ImGui dependency noise, not masquerade ^[strings.txt:27918] ^[strings.txt:30107] ^[strings.txt:35422].

How To Mess With It (Homelab Replication)

1. Toolchain: Visual Studio 2022 (v143) targeting x64 with /std:c++20.
2. Dependencies: Dear ImGui + imgui_impl_win32.cpp + imgui_impl_dx11.cpp; DirectX 11 SDK; nlohmann/json for client_dll.json parsing.
3. Core loop:
   • Open cs2.exe with PROCESS_VM_READ|PROCESS_VM_WRITE via OpenProcess.
   • Resolve client.dll base via K32EnumProcessModulesEx + GetModuleFileNameA.
   • Read JSON schema offsets at runtime.
   • Poll entity list via NtReadVirtualMemory.
   • Draw ImGui overlay in a layered WS_EX_LAYERED window.
   • Write aim angles / recoil offsets back via NtWriteVirtualMemory.
4. Privilege: Request requireAdministrator in the application manifest.
5. Verification: Build with identical linker settings (/DYNAMICBASE, /HIGHENTROPYVA, /NXCOMPAT) and compare section sizes and entropy to this sample. Run strings | grep -i 'imgui' | wc -l — expect thousands of hits.

Deployable Signatures

YARA rule

rule d52f85_cs2_cheat_overlay {
    meta:
        description = "CS2 external cheat overlay dropped by Amadey (d52f85 family)"
        author      = "corpus-triage"
        hash        = "2fb095b1ad49aa816bc15a373bc7ffdf70eddc37a66e0f647c834d4413290150"
        date        = "2026-06-09"
    strings:
        $s1  = "client.dll base:" ascii wide
        $s2  = "Essentials External" ascii wide
        $s3  = "client_dll.json" ascii wide
        $s4  = "Offsets.json" ascii wide
        $s5  = "Failed to initialize game memory manager." ascii wide
        $s6  = "NtUserInjectMouseInput" ascii wide
        $s7  = "NtUserInjectKeyboardInput" ascii wide
        $s8  = "aim_enable" ascii wide
        $s9  = "esp_enable" ascii wide
        $s10 = "chamsEnabled" ascii wide
        $s11 = "triggerbot" ascii wide
        $pdb = "cheetah\\x64\\Release\\cheetah.pdb" ascii wide
        $imgui1 = "Forgot to shutdown Renderer backend?" ascii wide
        $imgui2 = "imgui-error" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        filesize > 3MB and
        (4 of ($s*) or $pdb) and
        any of ($imgui*)
}

Behavioral fingerprint

This is a console-subsystem PE64 built with MSVC 14.50, with a Standard C Library entrypoint that chains to a main function. It imports only KERNEL32.dll (process/toolhelp APIs, file mapping, heap, SRW locks), USER32.dll (windowing, input, clipboard), ADVAPI32.dll (OpenProcessToken, GetTokenInformation), SHELL32.dll (ShellExecuteW), and MSVCP140.dll. No network DLLs are imported. At runtime it opens a target game process by name, resolves client.dll and engine2.dll module bases via toolhelp snapshots, reads a local JSON schema file, and enters a render/input loop using NtReadVirtualMemory/NtWriteVirtualMemory against the game process. The overlay is a layered (WS_EX_LAYERED) ImGui window. No C2 traffic is generated; the binary is entirely self-contained after initial delivery.

IOC list

Detection Signatures

Capa signatures were unavailable; no ATT&CK technique mapping was produced automatically. Based on imports + strings, the following ATT&CK techniques are inferable:

References

• Artifact ID: 3db58c41-ad81-4bdc-aa00-db0ae71c5ddf
• OpenCTI label: d52f85 + dropped-by-amadey
• Source: MalwareBazaar via OpenCTI urlhaus-recent-payloads connector
• Related wiki pages: d52f85, 9d2ca3
• MalwareBazaar record: https://bazaar.abuse.ch/sample/2fb095b1ad49aa816bc15a373bc7ffdf70eddc37a66e0f647c834d4413290150/

Provenance

This report was produced from the following static artifacts collected by the triage pipeline (tool versions unknown, dates from artifact timestamps):

• file.txt — file identification (PE32+ x86-64)
• exiftool.json — ExifTool 12.76 PE header metadata
• pefile.txt — pefile or peparser section/import/directory dump
• strings.txt — strings -n 6 ASCII strings
• rabin2-info.txt — radare2 rabin2 -I header summary
• floss.txt — FireEye floss (failed due to CLI arg collision)
• capa.txt — Mandiant capa (failed due to missing signature directory)
• yara.txt — yara generic PE match only
• binwalk.txt — Binwalk signatures (false-positive MySQL ISAM noise from font data)
• triage.json — pipeline schema metadata

Dynamic analysis was skipped because no CAPE Windows guest was available at the time of processing ^[dynamic-analysis.md]. All TTPs are static-only inferences.