Threat Group Cards: A Threat Actor Encyclopedia Archived: 2026-04-05 20:06:12 UTC Home > List all groups > List all tools > List all groups using tool CheeseTray Tool: CheeseTray Names CheeseTray CROWDEDFLOUNDER Category Malware Type Backdoor Description (US-CERT) This report analyzes a Themida packed 32-bit Windows executable, which is designed to unpack and execute a Remote Access Trojan (RAT) binary in memory. This application is designed to accept arguments during execution or can be installed as a service with command line arguments. It is designed to listen as a proxy for incoming connections containing commands or can connect to a remote server to receive commands. Information Malpedia Last change to this tool card: 24 April 2021 Download this tool card in JSON format All groups using tool CheeseTray Changed Name Country Observed APT groups   Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025 1 group listed (1 APT, 0 other, 0 unknown) Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1369ca74-ed23-426b-9b2c-d431f65b781c https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1369ca74-ed23-426b-9b2c-d431f65b781c Page 1 of 1