{
  "family": "skeeyah",
  "sample_count": 440,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nSkeeyah (often detected as Trojan.Skeeyah or Win32/Skeeyah) is a highly generic heuristic detection name utilized primarily by Windows Defender (Microsoft) to classify executable files exhibiting severe, Trojan-like behavioral characteristics. The \"Skeeyah\" designation does not point to a single malware family, but rather serves as a catch-all for heavily obfuscated, potentially severe threats that are acting as downloaders, backdoors, or credential stealers.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDue to its generic nature, a Skeeyah detection can originate from virtually any infection vector, including malspam attachments, drive-by downloads from exploit kits, or execution of trojanized \"cracked\" software from P2P networks.\n\nWhen Windows Defender flags a file as Skeeyah, it has detected multiple red-flag behaviors indicative of advanced malware:\n<ul>\n<li><strong>Severe Obfuscation:</strong> The executable is heavily packed, encrypted, or utilizes polymorphic techniques specifically designed to evade static, signature-based scanning engines.</li>\n<li><strong>Process Injection:</strong> The malware likely attempts to utilize Process Hollowing or DLL Injection to hide its malicious code within the memory space of legitimate Windows processes (such as `svchost.exe` or `explorer.exe`).</li>\n<li><strong>System Tampering:</strong> Skeeyah detections often trigger when a file attempts to aggressively modify critical registry keys, establish hidden persistence mechanisms, or actively disable Windows Defender's real-time protection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Trojan:Win32/Skeeyah detection must be treated as a high-severity incident. Because it is a heuristic flag for highly obfuscated malware, the actual payload is unknown until dynamically analyzed, but it frequently precedes the deployment of catastrophic enterprise ransomware or sophisticated remote access trojans (RATs).\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Quarantine and Network Isolation:</strong> Ensure the EDR solution has successfully quarantined the file and killed its parent process. Isolate the affected endpoint from the corporate network to prevent potential lateral movement.</li>\n<li><strong>Dynamic Malware Sandbox Analysis:</strong> Security analysts must extract the quarantined file and execute it within a secure, isolated malware sandbox (e.g., Cuckoo Sandbox) to observe its behavioral telemetry, determine its true intent, and extract Command and Control (C2) indicators.</li>\n<li><strong>Proactive Threat Hunting:</strong> Utilize the IOCs (Indicators of Compromise) generated by the sandbox analysis to sweep the entire corporate environment, ensuring the unknown threat has not bypassed defenses on other machines.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan:Win32/Skeeyah",
    "Malware.Skeeyah",
    "Trojan.Generic.Skeeyah"
  ],
  "enrichment_level": "documented_reference_only",
  "faq": [
    {
      "@type": "Question",
      "name": "Where can I learn more about skeeyah?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Refer to the linked MITRE ATT&CK technique pages, which document the behaviors associated with this family."
      }
    }
  ],
  "faq_count": 1,
  "mitre_attack": [
    "T1055",
    "T1027",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T09:04:51Z",
  "type": "Trojan (Generic Detection)",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}