Severity
High
Analysis Summary
DarkTortilla is a highly obfuscated, .NET-based malware crypter active since at least 2015. It is primarily linked to the financially motivated threat group GOLD CAMOUFLAGE, which operates DarkTortilla as a malware distribution service. Designed to deliver a wide range of payloads, it is frequently used to deploy info-stealers (AgentTesla, RedLine, NanoCore, AsyncRAT) and sometimes advanced tools like Cobalt Strike.
Known by aliases like "win.darktortilla", this malware features strong anti-analysis and evasion techniques, including process injection and in-memory execution to avoid detection. Its modular design allows for high configurability, enabling threat actors to adjust payloads, persistence methods, and communication protocols.
Recent campaigns show DarkTortilla masquerading as legitimate installers from brands like Grammarly and Cisco, distributed through phishing websites. Victims are lured into downloading malicious files, which then deploy the crypter to establish persistence, contact command-and-control (C2) servers, and deliver secondary payloads for data theft and espionage.
DarkTortilla has been used in targeted attacks in Kazakhstan, where it was coupled with AgentTesla to steal personal data. Its flexibility has made it a tool of choice for attacks across government, finance, critical infrastructure, and individual users, particularly in Central Asia, but its impact is global.
In summary, DarkTortilla serves as a powerful delivery mechanism for cybercriminals, offering stealth, adaptability, and effectiveness in a wide range of malware campaigns.
Impact
- Data Theft
- Cyber Espionage
Indicators of Compromise
MD5
3707d76e3f3f2b2d9c262d846ce84ea0
ef56ceeddf5ba59ac0fa0d5b195932f0
49a8fefe9eb5eaa59e2da51833ea1d0a
0abb0b3f54389bb5f6de00c38a7f2393
SHA-256
c657660bce96a5fadf3390883849fc322b606f0a0c497fd639c7a49ecd920c15
87fe3267b683590bfefe5041835233c058dfcc764e427f201fa550cd89fb3133
9cc00b1af48acb7af7f3c53d0a1adbe928d4bda26273dd955120ca138bdf2eca
b02b279161596d4cfb6a031d2354460ab7d4918b0963f24a24560c2014ca9251
SHA1
8e4360d09aad48470f0d08b43190540058e5d8ac
06b0902a31ce2a1b1702e29e87f6d7c0205f9a32
c8d5b3a9f6a2afadbfda3dc2ce539d6ae171f957
f4021615d2d7d5c77ea623f3d42ebafe27b8809e
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Upgrade your operating system.
- Don't open files and links from unknown sources.
- Install and run anti-virus scans.