{
  "family": "skorik",
  "sample_count": 70,
  "category": "trojan",
  "description": "Skorik (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Skorik and Trojan.Win32.Skorik) is a Windows trojan and surveillance stager active since 2013. Designed to compromise host integrity and facilitate persistent unauthorized access, Skorik is typically distributed through malicious spam attachments, cracked software packages, and deceptive file-sharing networks. Upon execution, Skorik creates hidden binaries in the %AppData% directory, modifies Windows registry Run keys for automatic persistence, and injects malicious execution threads into legitimate system processes like explorer.exe. It establishes outbound command-and-control communication over HTTP/HTTPS, enabling remote operators to upload and download files, gather detailed operating system configurations, and deploy secondary malware payloads such as keyloggers and cryptocurrency miners.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Skorik",
    "Trojan.Win32.Skorik",
    "Win32/Skorik"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Skorik?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Skorik is a Windows trojan that establishes autostart persistence, injects into processes, and downloads secondary payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Skorik infect host endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through malicious email attachments, torrent downloads, and deceptive software packages."
      }
    },
    {
      "@type": "Question",
      "name": "What persistence mechanisms are used by Skorik?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It drops hidden executables in %AppData% and registers registry Run keys to start automatically on login."
      }
    },
    {
      "@type": "Question",
      "name": "What malicious actions can remote operators execute via Skorik?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "They can collect system telemetry, upload/download arbitrary files, and stage secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How do administrators remove Skorik from an infected computer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the machine, delete startup keys under CurrentVersion\\Run, and run a complete offline antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1055",
    "T1547.001",
    "T1105",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session.",
    "Capture a full forensic memory image of the machine to extract the decrypted Skorik payload and its C2 configuration.",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Skorik persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Unauthorized Access & Payload Staging",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2013,
  "threat_actor": null,
  "delivery_mechanism": [
    "Malicious Spam Attachments",
    "Cracked Software & Keygens",
    "Deceptive Download Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Process Thread Injection",
    "Secondary Payload Downloading",
    "System Hardware Profiling",
    "Registry Autostart Persistence",
    "Encrypted HTTP C2 Communication"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST beacons sending host identifiers to remote C2 IP addresses",
      "Periodic keep-alive requests using custom user-agent headers"
    ],
    "evasion_techniques": [
      "Thread injection into explorer.exe to mask network traffic",
      "Obfuscated binary strings decoded during runtime"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SkorikClient",
      "%AppData%\\Skorik\\skorik_svc.exe"
    ]
  },
  "impact": {
    "confidentiality": "Medium",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Unauthorized remote control, secondary threat staging, system configuration leakage"
  },
  "lineage": {
    "derived_from": [
      "Win32 Trojan Loader Architectures"
    ],
    "variants": [
      "Skorik.A",
      "Skorik.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c",
      "2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d"
    ],
    "delivery": [
      "installer_skorik.exe",
      "update_patch.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SkorikUpdate",
      "%AppData%\\Skorik\\skorik.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Skorik",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Skorik"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan.Win32.Skorik",
      "url": "https://securelist.com"
    }
  ]
}