Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

skuld_protected.exe

windows7-x64

10

skuld_protected.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    skuld_protected.exe

  • Size

    8.2MB

  • Sample

    250324-215bwsxwgz

  • MD5

    53171de70bb7139d01253475b3edf69d

  • SHA1

    d3653eeb3b0186f98d90906d31bba029abd4d7b3

  • SHA256

    bdfc7afbb8e9da764dfd6256b289214a58a42aa43f195a2a475004f65508d9aa

  • SHA512

    673650773974a99ab67c8560076421cd741c2e516ff073dbf2605a99881b5ae58afe39ea7ffaa813bfa995eec479cdb1e511cb503b334eb2088ce9cc3eb5a0d7

  • SSDEEP

    196608:cu61rj+K0BAlTzhD5cPtodCbdYzgB4l8t0m3Kv26Hz83S0:0Z0MdcnpsRv6KvVTR0

Score
10/10
skulddefense_evasionstealerthemidatrojan

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1353860432762372188/A1186uEBicdAwCu0FmKv96jtyFw-8SuTgxcvz4OTlmMYzeW-r7U2BlP4scfVJ8yH-jKr

Targets

    • Target

      skuld_protected.exe

    • Size

      8.2MB

    • MD5

      53171de70bb7139d01253475b3edf69d

    • SHA1

      d3653eeb3b0186f98d90906d31bba029abd4d7b3

    • SHA256

      bdfc7afbb8e9da764dfd6256b289214a58a42aa43f195a2a475004f65508d9aa

    • SHA512

      673650773974a99ab67c8560076421cd741c2e516ff073dbf2605a99881b5ae58afe39ea7ffaa813bfa995eec479cdb1e511cb503b334eb2088ce9cc3eb5a0d7

    • SSDEEP

      196608:cu61rj+K0BAlTzhD5cPtodCbdYzgB4l8t0m3Kv26Hz83S0:0Z0MdcnpsRv6KvVTR0

    Score
    10/10
    skulddefense_evasionstealerthemidatrojan

    • Skuld family

      skuld

    • Skuld stealer

      An info stealer written in Go lang.

      stealerskuld

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks