DarkTortilla

Description

DarkTortilla is a highly configurable .NET based crypter that has possibly been active since August 2015. It delivers information stealers, remote access trojans, and other payloads such as Agent Tesla, AsyncRAT, NanoCore, RedLine, Cobalt Strike, and Metasploit.

Stats

First seen: February 2023
Last seen: October 2026

Also known as

Darktortilla

MITRE ATT&CK techniques

28 techniques across 8 tactics.

TA0001 Initial Access

T1566Phishing
- T1566.001Spearphishing Attachment

TA0002 Execution

T1047Windows Management Instrumentation
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1106Native API
T1204User Execution
- T1204.002Malicious File
T1559Inter-Process Communication
- T1559.001Component Object Model

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder
- T1547.004Winlogon Helper DLL

TA0005 Stealth

T1027Obfuscated Files or Information
T1036Masquerading
T1055Process Injection
- T1055.001Dynamic-link Library Injection
T1140Deobfuscate/Decode Files or Information
T1497Virtualization/Sandbox Evasion
- T1497.003Time Based Checks
- T1497.001System Checks
T1564Hide Artifacts
T1574Hijack Execution Flow
- T1574.012COR_PROFILER
T1622Debugger Evasion

TA0007 Discovery

T1007System Service Discovery
T1016System Network Configuration Discovery
- T1016.001Internet Connection Discovery
T1057Process Discovery
T1082System Information Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging
T1115Clipboard Data

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1102Web Service
T1105Ingress Tool Transfer

TA0112 Defense Impairment

T1112Modify Registry

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Trojan.Darktortilla	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.DarkTortilla	ATP Sandbox Adv. Heuristics
Gen:Variant.Cerbu.DarkTortilla.134368	AV
Win32.Exploit.DarkTortilla	ATP Sandbox Adv. Heuristics
Win32.Ransomware.DarkTortilla	ATP Sandbox Adv. Heuristics
Win32.Spyware.DarkTortilla	ATP Sandbox Adv. Heuristics
Win32.Trojan.DarkTortilla	ATP Sandbox Adv. Heuristics

Related families

QakBot Bumblebee DarkGate Latrodectus TrickBot