darthvader | cb80616543ced795ef0f5197a4b24f23a74d736253da011bfaa5e8baed5c0e8a

General

Target
cb80616543ced795ef0f5197a4b24f23a74d736253da011bfaa5e8baed5c0e8a
Size 1.8MB
Sample260604-syffbaav2j
SHA256 cb80616543ced795ef0f5197a4b24f23a74d736253da011bfaa5e8baed5c0e8a
MD5 bb222b8eeba085da84392967eb1cfa88
SHA1 73840e1b36f8492052c6de5158fea8f1c6419d97
SHA512 d61338225b7f2b7f142cf1b65ba1a31ca00c1bf28e1f351cf767d12844fa5c69705509cfa7c3d6cf65ea4259b04cb8e52a0c50be414601ce25a034eee1b67cd2
SSDEEP 49152:TGOiH61lokNzDtEVgaRuGIlqhs+km8ir6xxHI:+KloSWVTR5Nhsm8A6xx
TLSH
T12D85E01873F84629F1FF4B359972501886B3B89BAA20C74E0C52594E1E71F81DDAAF73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer darthvader

Malware Config

Extracted

Family

darthvader

C2

178.156.225.48:4662
135.181.77.225:4662
217.216.92.111:4662

Mutex

Global\RemoteControlClient_0x4ND4R1LH0

Attributes

client_dll
skywalker.dll
client_exe
Client.exe
deploy_token
a7f3b9c2e1d4f6a8b0c3d5e7f9a1b2c4
guardian_resource
MicrosoftEdgeTelemetry
schtask_name
MicrosoftEdgeUpdateCheck
servers_file
.svcdns.dat
tor_bundle_url
https://archive.torproject.org/tor-package-archive/torbrowser/15.0.7/tor-expert-bundle-windows-x86_64-15.0.7.tar.gz
web_port
8181

Signatures

Family: DarthVader, SkyWalker
DarthVader aka SkyWalker is a stealer written in C#.
stealer darthvader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb80616543ced795ef0f5197a4b24f23a74d736253da011bfaa5e8baed5c0e8a

File Explorer

cb80616543ced795ef0f5197a4b24f23a74d736253da011bfaa5e8baed5c0e8a

.dll 1.8MB

cb80616543ced795ef0f5197a4b24f23a74d736253da011bfaa5e8baed5c0e8a

SHA256 cb80616543ced795ef0f5197a4b24f23a74d736253da011bfaa5e8baed5c0e8a
MD5 bb222b8eeba085da84392967eb1cfa88
SHA1 73840e1b36f8492052c6de5158fea8f1c6419d97
SHA512 d61338225b7f2b7f142cf1b65ba1a31ca00c1bf28e1f351cf767d12844fa5c69705509cfa7c3d6cf65ea4259b04cb8e52a0c50be414601ce25a034eee1b67cd2
SSDEEP 49152:TGOiH61lokNzDtEVgaRuGIlqhs+km8ir6xxHI:+KloSWVTR5Nhsm8A6xx
TLSH
T12D85E01873F84629F1FF4B359972501886B3B89BAA20C74E0C52594E1E71F81DDAAF73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Source\14_04_2026\ClientDll\obj\x64\Release\sky_sinistro_noexport.pdb

Sharing