darthvader | e10dbc117d0ddbcb00210af75e7e1e94eed4d97951850ce0a2b06589bb8a0797

General

Target
e10dbc117d0ddbcb00210af75e7e1e94eed4d97951850ce0a2b06589bb8a0797
Size 1.8MB
Sample260604-sygclsav2p
SHA256 e10dbc117d0ddbcb00210af75e7e1e94eed4d97951850ce0a2b06589bb8a0797
MD5 2a8432e0f2af4e0c3d44cc84dfb94aae
SHA1 7dcf28adc65ff0740491840881041615a6db0fb3
SHA512 2a4bb4b9501b17bd642600d30671411e637ab774b545006c42808e1861fd3c02b4d843e1be618f1d5bb677422d7049e1323379bd4c0d9478b03f7d359dc5f27e
SSDEEP 49152:paDOiH61lokNzDtEVgaRuGIlqhs+km8ir6xxHI:svKloSWVTR5Nhsm8A6xx
TLSH
T16285E01873F84629F0FF4B359972501886B3B89BA920C74E0D92594E1E71F81DDAAF73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer darthvader

Malware Config

Extracted

Family

darthvader

C2

178.156.225.48:4662
135.181.77.225:4662
217.216.92.111:4662

Mutex

Global\RemoteControlClient_0x4ND4R1LH0

Attributes

client_dll
skywalker.dll
client_exe
Client.exe
deploy_token
a7f3b9c2e1d4f6a8b0c3d5e7f9a1b2c4
guardian_resource
MicrosoftEdgeTelemetry
schtask_name
MicrosoftEdgeUpdateCheck
servers_file
.svcdns.dat
tor_bundle_url
https://archive.torproject.org/tor-package-archive/torbrowser/15.0.7/tor-expert-bundle-windows-x86_64-15.0.7.tar.gz
web_port
8181

Signatures

Family: DarthVader, SkyWalker
DarthVader aka SkyWalker is a stealer written in C#.
stealer darthvader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e10dbc117d0ddbcb00210af75e7e1e94eed4d97951850ce0a2b06589bb8a0797

File Explorer

e10dbc117d0ddbcb00210af75e7e1e94eed4d97951850ce0a2b06589bb8a0797

.dll 1.8MB

e10dbc117d0ddbcb00210af75e7e1e94eed4d97951850ce0a2b06589bb8a0797

SHA256 e10dbc117d0ddbcb00210af75e7e1e94eed4d97951850ce0a2b06589bb8a0797
MD5 2a8432e0f2af4e0c3d44cc84dfb94aae
SHA1 7dcf28adc65ff0740491840881041615a6db0fb3
SHA512 2a4bb4b9501b17bd642600d30671411e637ab774b545006c42808e1861fd3c02b4d843e1be618f1d5bb677422d7049e1323379bd4c0d9478b03f7d359dc5f27e
SSDEEP 49152:paDOiH61lokNzDtEVgaRuGIlqhs+km8ir6xxHI:svKloSWVTR5Nhsm8A6xx
TLSH
T16285E01873F84629F0FF4B359972501886B3B89BA920C74E0D92594E1E71F81DDAAF73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Source\14_04_2026\ClientDll\obj\x64\Release\sky_blackrock_noexport.pdb

Sharing