darthvader | f32fda476efecc1644cff0103f0979d3f0718ea983ca176043823f50f85a38f0

General

Target
f32fda476efecc1644cff0103f0979d3f0718ea983ca176043823f50f85a38f0
Size 364KB
Sample260604-syhknshy3t
SHA256 f32fda476efecc1644cff0103f0979d3f0718ea983ca176043823f50f85a38f0
MD5 e76e911dbe7fcbb0674506048ec7a50d
SHA1 8c96f14faaf1142cea75206f2a43fe4e03451c80
SHA512 8810cc6dad4c43eeeac03ae8d8b88c231220056c2c6c37ac5cd6fa42e33566a6f3ffdfe52113a3814e2c125cf8d8aa067e0bbc8dfc342d2461115bf5d5835f62
SSDEEP 6144:I+ceW6iAL5hzPd93oidSPOBsb45BQyKEgHlWxwGtbtAYxrHIfsw:I2W61DdmmyOBFBQymFKAYxrHIfs
TLSH
T12684CF5CB794A68FC877CA7289F48C526A30B0676717E34B749F03AC4F0D686CE152A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

darthvader

C2

178.156.225.48:4662
135.181.77.225:4662
217.216.92.111:4662

Mutex

Global\RemoteControlClient_0x4ND4R1LH0

Attributes

client_dll
skywalker.dll
client_exe
Client.exe
deploy_token
a7f3b9c2e1d4f6a8b0c3d5e7f9a1b2c4
guardian_resource
WindowsProtectionService
schtask_name
MicrosoftEdgeUpdateCheck
servers_file
.svcdns.dat
tor_bundle_url
https://archive.torproject.org/tor-package-archive/torbrowser/15.0.7/tor-expert-bundle-windows-x86_64-15.0.7.tar.gz
watchdog_dll
[UPDATE]
web_port
8181

Targets

- Target
  CONFIG.DLL
- Size 276KB
- SHA256 9e7a0a8a188b1e9d0a04ee1a0b150ba8c101a3c5dbeb6a1460337df0599e67bc
- MD5 335c2e8f20ef1b5440f544036e3470cc
- SHA1 ba1223a1cc38ef552ac018c612a1568d1cf1dfb5
- SHA512 ac2ab20adfac92ca52de2a48e3792a15f84a1894f09f8ac368d53f6888b7ecf41302ec7d5c67b7470eb4a54e9ac5991b0f5b4286afa828d76df24666b1abce73
- SSDEEP 6144:4+ceW6iAL5hzPd93oidSPOBsb45BQyKEgHlWxwGtbtAYxrHIf:42W61DdmmyOBFBQymFKAYxrHIf
- TLSH
  T17854DF8C7754F9CFC86BC9729DA44C656A60B47B6307E343A89712EC9D0D99BCE180E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  FACTURA_2QZ7GR.PDF.EXE
- Size 42KB
- SHA256 92aa7689723fd08b61ce396b9bc27893385d6e1578917ebfc22f05c8bc30a188
- MD5 b67a67922f2bf068f52c8128459309b6
- SHA1 ad9383311813623752b24515049927a2ba9bffa7
- SHA512 0080a95f4f144ac41a0167f2cc2413f852cbdfeb866dc4761cbc964f035a5eecd71e445b4ce8792359938e9f6c0a871532ce9809d7c0d8e59dc2d6651bb06013
- SSDEEP 384:WvfIQRb67dOwRkMKJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+UsPZlQWesn5fr:W3IX7dC6Iq8IMvQIWzM985HDk
- TLSH
  T13B13C528DBE81312F2B34BB099F5C483AE36B653AD75D75C348E93490A627845A1373E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware discovery darthvader persistence spyware stealer
- Family: DarthVader, SkyWalker
  DarthVader aka SkyWalker is a stealer written in C#.
  stealer darthvader
- Drops startup file
- Adds Run key to start application
  persistence
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral3 behavioral4