Severity
High
Analysis Summary
DarkTortilla is a highly obfuscated, .NET-based malware crypter active since at least 2015. It is primarily linked to the financially motivated threat group GOLD CAMOUFLAGE, which operates DarkTortilla as a malware distribution service. Designed to deliver a wide range of payloads, it is frequently used to deploy info-stealers (AgentTesla, RedLine, NanoCore, AsyncRAT) and sometimes advanced tools like Cobalt Strike.
Known by aliases like "win.darktortilla", this malware features strong anti-analysis and evasion techniques, including process injection and in-memory execution to avoid detection. Its modular design allows for high configurability, enabling threat actors to adjust payloads, persistence methods, and communication protocols.
Recent campaigns show DarkTortilla masquerading as legitimate installers from brands like Grammarly and Cisco, distributed through phishing websites. Victims are lured into downloading malicious files, which then deploy the crypter to establish persistence, contact command-and-control (C2) servers, and deliver secondary payloads for data theft and espionage.
DarkTortilla has been used in targeted attacks in Kazakhstan, where it was coupled with AgentTesla to steal personal data. Its flexibility has made it a tool of choice for attacks across government, finance, critical infrastructure, and individual users, particularly in Central Asia, but its impact is global.
In summary, DarkTortilla serves as a powerful delivery mechanism for cybercriminals, offering stealth, adaptability, and effectiveness in a wide range of malware campaigns.
Impact
- Data Theft
- Cyber Espionage
Indicators of Compromise
MD5
1278afae4cff4c17a5826d8a8a878b1e
a0be3b51d5dcde4759b282bc9c53773a
dd35e64c81a61540713f2ea9bd763a7f
SHA-256
2d1dd37c3915997fc19c4e01e6daa7f518782d5dba0cfccf9947703ed6ca7c04
8ef7abfdd24d21c93e8eea69b21c11e77ecfd54f2bd7cd2b96828c60ad26791b
c28e2c53bc6c36944f7b3fd5265b3fbe614ef947024457930610490e8dcd49ea
SHA1
a40c8259a707e66b56c6f614ccb44fe736683d22
0dd761694fef56551ae23f8e73a8fb403b3c9d8e
bd415c0881302dd4a76f5bdbd8767a49293a488c
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Upgrade your operating system.
- Don't open files and links from unknown sources.
- Install and run anti-virus scans.