Analysis Summary

DarkTortilla is a highly obfuscated, .NET-based malware crypter active since at least 2015. It is primarily linked to the financially motivated threat group GOLD CAMOUFLAGE, which operates DarkTortilla as a malware distribution service. Designed to deliver a wide range of payloads, it is frequently used to deploy info-stealers (AgentTesla, RedLine, NanoCore, AsyncRAT) and sometimes advanced tools like Cobalt Strike.

Known by aliases like "win.darktortilla", this malware features strong anti-analysis and evasion techniques, including process injection and in-memory execution to avoid detection. Its modular design allows for high configurability, enabling threat actors to adjust payloads, persistence methods, and communication protocols.

Recent campaigns show DarkTortilla masquerading as legitimate installers from brands like Grammarly and Cisco, distributed through phishing websites. Victims are lured into downloading malicious files, which then deploy the crypter to establish persistence, contact command-and-control (C2) servers, and deliver secondary payloads for data theft and espionage.

DarkTortilla has been used in targeted attacks in Kazakhstan, where it was coupled with AgentTesla to steal personal data. Its flexibility has made it a tool of choice for attacks across government, finance, critical infrastructure, and individual users, particularly in Central Asia, but its impact is global.

In summary, DarkTortilla serves as a powerful delivery mechanism for cybercriminals, offering stealth, adaptability, and effectiveness in a wide range of malware campaigns.

Impact

• Data Theft
• Cyber Espionage

Indicators of Compromise

SHA1

• a40c8259a707e66b56c6f614ccb44fe736683d22

• 0dd761694fef56551ae23f8e73a8fb403b3c9d8e

• bd415c0881302dd4a76f5bdbd8767a49293a488c

Remediation

• Block all threat indicators at your respective controls.
• Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Upgrade your operating system.
• Don't open files and links from unknown sources.
• Install and run anti-virus scans.