Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    SkouAIO.exe

  • Size

    7.2MB

  • Sample

    240908-dmpsaasbnl

  • MD5

    f3b1ff3cf8dd2f1495a9c7b3e1990524

  • SHA1

    4133e5f69660134d3f5cb6dce64b9b57f97c5117

  • SHA256

    169b8c638fbaf5cbc487b3ac7556377cbaccb9bbc2a5809cff0ba276316d219f

  • SHA512

    eda45ef97f3330eed85fd604518a08fc2a18122ae2c5438842e906001771f52a710dfbce288d94d3c87627ec719e0cc6364805482d2ee9b651403e96d20f9c2b

  • SSDEEP

    196608:bx5QeRC8Hy5iSV4ArdlLAeg5QETwb5fk2lbIn:bxuQHy5vV4Ardueop0k2lbM

Malware Config

Targets

    • Target

      SkouAIO.exe

    • Size

      7.2MB

    • MD5

      f3b1ff3cf8dd2f1495a9c7b3e1990524

    • SHA1

      4133e5f69660134d3f5cb6dce64b9b57f97c5117

    • SHA256

      169b8c638fbaf5cbc487b3ac7556377cbaccb9bbc2a5809cff0ba276316d219f

    • SHA512

      eda45ef97f3330eed85fd604518a08fc2a18122ae2c5438842e906001771f52a710dfbce288d94d3c87627ec719e0cc6364805482d2ee9b651403e96d20f9c2b

    • SSDEEP

      196608:bx5QeRC8Hy5iSV4ArdlLAeg5QETwb5fk2lbIn:bxuQHy5vV4Ardueop0k2lbM

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks