darthvader | 24062026_0549_sky_maskara_noexport[.]dll

General

Target
24062026_0549_sky_maskara_noexport.dll
Size 1.2MB
Sample260624-gh2stsat2v
SHA256 28cfbcc30d81f082c80155ef9b6f33b790a6f01831fb7053cf81f2e34aa81cd5
MD5 cb9f0922db48967b93e06810b0b6dd47
SHA1 30646ffbbd5466cae160f8f52ed71b312620c8ef
SHA512 3380ea1e52612f6cf245fd226d080748a637ed26fbcf6af121ff6a5edf0dd3e2fc5efe1b12d04245ca0abc2199503d0fddbd722e761b7a65cee864e3a81b629e
SSDEEP 24576:/rwD3MCQP3mpngU0/SZilOBonsVSlEI6z:jAMZ2Fz0/S2OBonsglEI6z
TLSH
T1F3559C4673F84A15F1BF1B75EA7251088973B96BA930CB0E0C99944E0F72F809DA5B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer darthvader

Malware Config

Extracted

Family

darthvader

C2

178.156.225.48:4662
135.181.77.225:4662
104.171.122.90:4662

Mutex

Global\RemoteControlClient_0x4ND4R1LH0

Attributes

client_dll
skywalker.dll
client_exe
Client.exe
deploy_token
a7f3b9c2e1d4f6a8b0c3d5e7f9a1b2c4
guardian_resource
MpCmdRun
schtask_name
MicrosoftEdgeUpdateCheck
servers_file
.svcdns.dat
tor_bundle_url
https://archive.torproject.org/tor-package-archive/torbrowser/15.0.7/tor-expert-bundle-windows-x86_64-15.0.7.tar.gz
watchdog_dll
[WARN] TEMPLATE_SUBMIT erro:
web_port
8181

Signatures

Family: DarthVader, SkyWalker
DarthVader aka SkyWalker is a stealer written in C#.
stealer darthvader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
24062026_0549_sky_maskara_noexport.dll

File Explorer

24062026_0549_sky_maskara_noexport.dll

.dll 1.2MB

24062026_0549_sky_maskara_noexport.dll

SHA256 28cfbcc30d81f082c80155ef9b6f33b790a6f01831fb7053cf81f2e34aa81cd5
MD5 cb9f0922db48967b93e06810b0b6dd47
SHA1 30646ffbbd5466cae160f8f52ed71b312620c8ef
SHA512 3380ea1e52612f6cf245fd226d080748a637ed26fbcf6af121ff6a5edf0dd3e2fc5efe1b12d04245ca0abc2199503d0fddbd722e761b7a65cee864e3a81b629e
SSDEEP 24576:/rwD3MCQP3mpngU0/SZilOBonsVSlEI6z:jAMZ2Fz0/S2OBonsglEI6z
TLSH
T1F3559C4673F84A15F1BF1B75EA7251088973B96BA930CB0E0C99944E0F72F809DA5B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Source\1\ClientDll\obj\x64\Release\sky_maskara_noexport.pdb

Sharing