Severity
High
Analysis Summary
DarkTortilla is a highly obfuscated, .NET-based malware crypter active since at least 2015. It is primarily linked to the financially motivated threat group GOLD CAMOUFLAGE, which operates DarkTortilla as a malware distribution service. Designed to deliver a wide range of payloads, it is frequently used to deploy info-stealers (AgentTesla, RedLine, NanoCore, AsyncRAT) and sometimes advanced tools like Cobalt Strike.
Known by aliases like "win.darktortilla", this malware features strong anti-analysis and evasion techniques, including process injection and in-memory execution to avoid detection. Its modular design allows for high configurability, enabling threat actors to adjust payloads, persistence methods, and communication protocols.
Recent campaigns show DarkTortilla masquerading as legitimate installers from brands like Grammarly and Cisco, distributed through phishing websites. Victims are lured into downloading malicious files, which then deploy the crypter to establish persistence, contact command-and-control (C2) servers, and deliver secondary payloads for data theft and espionage.
DarkTortilla has been used in targeted attacks in Kazakhstan, where it was coupled with AgentTesla to steal personal data. Its flexibility has made it a tool of choice for attacks across government, finance, critical infrastructure, and individual users, particularly in Central Asia, but its impact is global.
In summary, DarkTortilla serves as a powerful delivery mechanism for cybercriminals, offering stealth, adaptability, and effectiveness in a wide range of malware campaigns.
Impact
- Data Theft
- Cyber Espionage
Indicators of Compromise
MD5
693ec61085d84cab92226bf6a2403408
c157b825a19e77893b8ebe6d43e1165d
5e5c05503dda922fc0aea0b829ce2fd4
49d92213a83ee8600675199f261c580b
711fbcc28fba4fcfbb4f02aa94db65f0
SHA-256
84b6e7c39ea67509b28d31aa2544bab496562361af72e2ce5bb3e7158d90e746
738480ab58300675f57080ee683e73d854f5f3ed01cd846c2b0e98116a0d301f
2dec3beb719469f3f93e0c322f5d119347f0fb52e9f33495a16d5e9f6664b749
11a8fcd56d53f0cf7d1569de4fa9fdd0dfdc9c573563be24461623c904a12dbc
de7f47628188cb1ed46708ec2c9f3361f8e50cbd320f9912adeb209c8957bf39
SHA1
f795147513628e8cf8e262d942017643641fa144
b48b58269e743b7d9ce1b66ee6c55ee18da7beb8
6c224f3c45de4eff7d572c3f30534da96ae65873
54e1297324bd27d4672edfd73f07f48b51124104
8c9d0359271f99e1a0fc76a707c6469d90516566
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Upgrade your operating system.
- Don't open files and links from unknown sources.
- Install and run anti-virus scans.