Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
SkouAIO.exe
-
Size
7.2MB
-
Sample
240908-dmpsaasbnl
-
MD5
f3b1ff3cf8dd2f1495a9c7b3e1990524
-
SHA1
4133e5f69660134d3f5cb6dce64b9b57f97c5117
-
SHA256
169b8c638fbaf5cbc487b3ac7556377cbaccb9bbc2a5809cff0ba276316d219f
-
SHA512
eda45ef97f3330eed85fd604518a08fc2a18122ae2c5438842e906001771f52a710dfbce288d94d3c87627ec719e0cc6364805482d2ee9b651403e96d20f9c2b
-
SSDEEP
196608:bx5QeRC8Hy5iSV4ArdlLAeg5QETwb5fk2lbIn:bxuQHy5vV4Ardueop0k2lbM
Malware Config
Targets
-
-
Target
SkouAIO.exe
-
Size
7.2MB
-
MD5
f3b1ff3cf8dd2f1495a9c7b3e1990524
-
SHA1
4133e5f69660134d3f5cb6dce64b9b57f97c5117
-
SHA256
169b8c638fbaf5cbc487b3ac7556377cbaccb9bbc2a5809cff0ba276316d219f
-
SHA512
eda45ef97f3330eed85fd604518a08fc2a18122ae2c5438842e906001771f52a710dfbce288d94d3c87627ec719e0cc6364805482d2ee9b651403e96d20f9c2b
-
SSDEEP
196608:bx5QeRC8Hy5iSV4ArdlLAeg5QETwb5fk2lbIn:bxuQHy5vV4Ardueop0k2lbM
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-