darthvader | f0962135b85d507d54cd5256037977f8040194c1a32988b5b6b33594aa924923

General

Target
f0962135b85d507d54cd5256037977f8040194c1a32988b5b6b33594aa924923
Size 256KB
Sample260604-stjbeahw7s
SHA256 f0962135b85d507d54cd5256037977f8040194c1a32988b5b6b33594aa924923
MD5 b8909e0b7e710bf1ccc8c7aefa51e614
SHA1 3a13a3e71b2f18a928ec1a3f3843a7cedfe8d275
SHA512 2ba90bb09b684dcf6a89d454c9b26a4f7f6aeee2548ea046dd2c11f4f1c56fce6ffacbc9fc7ef793b826b0b164a947c5da6dafad961302d9c33af87f2348d331
SSDEEP 6144:jU5S3PwgT+jxD5ZU9HfEy149kUbxVUNp6ONZDvQVAWF:jH3Pw9/U9/Ey1gxVUHLguWF
TLSH
T1314423ED4CB90DF86E1DFC2694FBD84C55BA4082BC60A85B582C8FC83DFD451E86AC95
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

darthvader

C2

178.156.225.48:4662
135.181.77.225:4662
217.216.92.111:4662

Mutex

Global\RemoteControlClient_0x4ND4R1LH0

Attributes

client_dll
skywalker.dll
client_exe
Client.exe
deploy_token
a7f3b9c2e1d4f6a8b0c3d5e7f9a1b2c4
guardian_resource
WindowsProtectionService
schtask_name
MicrosoftEdgeUpdateCheck
servers_file
.svcdns.dat
tor_bundle_url
https://archive.torproject.org/tor-package-archive/torbrowser/15.0.7/tor-expert-bundle-windows-x86_64-15.0.7.tar.gz
watchdog_dll
[UPDATE]
web_port
8181

Targets

- Target
  CONFIG.DLL
- Size 268KB
- SHA256 707abdb3ef789ddc6b6f76f191cbc627fdab920a9f6145369faaa00cf7529c51
- MD5 02850f0331abdc9f902ac4fdbe250b8c
- SHA1 b24660bcb921f315c6728a8f763f80e6f57e92e2
- SHA512 f7da274d95ad1574e15364850797b8993f88f05de23365a41ba10e177e6d4b2628958a0c778d6b958fccb563f0b0fba9c4ab4578a9f7426329d92ed5d15ff87e
- SSDEEP 6144:IjzG3rwcT+VxD5ZM9hfEm1uPkU7x/2BxoYj2GmbC:Ei3rw3/M91Em1YxIoq
- TLSH
  T16844D04C7A6479DFCC1BCD728DA55C14AAA0A0A36717D347E85706EC6E0D6CBCF091E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  FACTURA_UIS0CR.PDF.EXE
- Size 42KB
- SHA256 92aa7689723fd08b61ce396b9bc27893385d6e1578917ebfc22f05c8bc30a188
- MD5 b67a67922f2bf068f52c8128459309b6
- SHA1 ad9383311813623752b24515049927a2ba9bffa7
- SHA512 0080a95f4f144ac41a0167f2cc2413f852cbdfeb866dc4761cbc964f035a5eecd71e445b4ce8792359938e9f6c0a871532ce9809d7c0d8e59dc2d6651bb06013
- SSDEEP 384:WvfIQRb67dOwRkMKJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+UsPZlQWesn5fr:W3IX7dC6Iq8IMvQIWzM985HDk
- TLSH
  T13B13C528DBE81312F2B34BB099F5C483AE36B653AD75D75C348E93490A627845A1373E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware discovery darthvader persistence spyware stealer
- Family: DarthVader, SkyWalker
  DarthVader aka SkyWalker is a stealer written in C#.
  stealer darthvader
- Drops startup file
- Adds Run key to start application
  persistence
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral3 behavioral4