> Family · d52f85_

~/packetpursuit $ cat /intel/families/d52f85.md

typeentityfamilyd52f85confidencemediumcreated2026-06-09updated2026-06-09malware-familypemsvcloaderanti-debugdefense-evasion

d52f85

OpenCTI internal family label for payloads dropped by the Amadey downloader botnet. In this corpus, d52f85 has been observed on a Counter-Strike 2 external cheat overlay (sample 2fb095b1), distinct from the 9d2ca3 Amadey cluster. The label is best treated as a distribution-channel grouping rather than an intrinsic malware family.

Overview

OpenCTI assigns d52f85 to samples co-tagged dropped-by-amadey. In the PacketPursuit corpus, the only observed d52f85 sample is a 4.6 MB MSVC-built PE32+ overlay cheat named "Cheetah" by its developer "nikor". It is an external aimbot/ESP/radar/chams trainer for Counter-Strike 2, delivered via Amadey to compromised hosts. Unlike the 9d2ca3 cluster — which contains MinGW droppers, Go infostealers, and .NET hollowing payloads — this sample is a self-contained game cheat with no encrypted inner payload, no C2, and no persistence mechanism. Its only delivery link to Amadey is the co-label. ^[/intel/analyses/2fb095b1ad49aa816bc15a373bc7ffdf70eddc37a66e0f647c834d4413290150.html]

Build Stack

  • Toolchain: MSVC 14.50 (Visual Studio 2022 v143), C++20, UCRT/ConCRT runtime.
  • Format: PE32+ x86-64, 6 sections (.text, .rdata, .data, .pdata, .rsrc, .reloc).
  • Linker flags: ASLR + DEP + High Entropy VA; Terminal Server Aware.
  • Signing: Unsigned.
  • PDB: C:\Users\nikor\source\repos\cheetah\x64\Release\cheetah.pdb — developer identity leak.
  • Obfuscation / packing: None. No UPX, Themida, VMProtect, or custom packer. Section entropies (6.29–6.67) are consistent with compiled C++ + ImGui + embedded font bitmaps.
  • Anti-analysis: None observed. No anti-VM, anti-debug, or sandbox gating.

Deploy / TTPs

Technique ID Evidence
Process Injection (cross-process memory manipulation) T1055.012 NtReadVirtualMemory, NtWriteVirtualMemory against cs2.exe / client.dll ^[/intel/analyses/2fb095b1ad49aa816bc15a373bc7ffdf70eddc37a66e0f647c834d4413290150.html]
Input Capture (API hooking / synthesis) T1056.004 NtUserInjectMouseInput, NtUserInjectKeyboardInput via win32u.dll for aimbot input injection
Discovery: Process Discovery T1057 CreateToolhelp32Snapshot, K32EnumProcessModulesEx, Process32FirstW/NextW to enumerate target game modules
Collection: Screen Capture T1113 ImGui overlay + screenshot capability used for ESP/radar
Defense Evasion: Masquerading T1036 "Essentials External v1.3" branding; game-cheat masquerade

Capabilities

  • external-process-memory-read
  • external-process-memory-write
  • input-injection-mouse-keyboard
  • game-state-schema-loader-json
  • imgui-overlay-render
  • aimbot-prediction-smoothing
  • esp-team-visibility-filter
  • chams-wireframe-rimlight
  • radar-overlay-mini-map
  • recoil-control-system
  • velocity-bunny-hop-assist
  • create-toolhelp-process-discovery
  • no-c2-self-contained
  • admin-elevation-gate

Notable Analyses

  • /intel/analyses/2fb095b1ad49aa816bc15a373bc7ffdf70eddc37a66e0f647c834d4413290150.html — Deep static analysis of the CS2 "Cheetah" external cheat.

Related

  • 9d2ca3 — Amadey-downloader-dropped second-stage payload cluster (MinGW + Go + .NET variants). Shares the dropped-by-amadey co-label but is build-distinct from this sample.
  • Amadey downloader (external, Malpedia win.amadey) — the upstream delivery mechanism.