DarkTortilla

MITRE ATT&CK: S1066 View on attack.mitre.org

Aliases: DarkTortilla

First seen
2015-08-01 00:00:00
Malware type
loader, trojan
Family
Malware family
Operating systems
windows
Related IoCs
445 (442 malicious)
Last IoC activity
2026-10-18 01:56:50
Profile updated
2026-07-07 14:43:17

Targeted industries: financial-services government-and-public-sector technology-and-telecommunications

Context

DarkTortilla is a highly configurable .NET-based crypter that has been possibly active since at least August 2015. DarkTortilla has been used to deliver popular information stealers, RATs, and payloads such as Agent Tesla, AsyncRat, NanoCore, RedLine, Cobalt Strike, and Metasploit.

Recent IoC activity

442 malicious indicators in Maltiverse are attributed to DarkTortilla (S1066). The 20 most recently updated:

TypeIndicatorUpdatedSources
file sample svvhost.exe 2026-10-18 3
file sample jaffacakes118_8ce78cb267a18e49ebe0e7094006b0309d9cf150adbe614fa94f01bed120c5e3 2026-10-16 1
file sample jaffacakes118_36d95d85810b023f1948d0facd6bac8cedac19301dd1a7d20e59ea9abacf5f76 2026-10-16 1
file sample jaffacakes118_08e42430057ae8800220e90a28104ab84c2e773dc19a23c0c596899228c8873a 2026-10-16 1
file sample jaffacakes118_97bac22cb50b75175dc78c05196740d6736e7c089ea390bf3dd6a749c1aec7e4 2026-10-16 1
file sample RDEHNJMHFFHTYGUJ.exe 2026-10-16 1
file sample 32b1ee8a28dbba3227b0346af5207e4dd7b80701dbf83f417f4ecf5d93699713 2026-10-14 1
file sample COTIZACION 08.10.2026 GRUPO 010.exe 2026-10-09 3
file sample 8c3c118894a68a3462534b9188e8ee485c31237fb28f74c73e71cccaf7c1fd2c 2026-10-08 1
file sample 0373bb7daadac9ccd70a5c44b5bba73aad57a26665b95c8d430b1425c69d5148 2026-10-05 1
file sample z1PONo_023578.bat 2026-10-04 3
file sample Quote.exe 2026-09-30 3
file sample TWS INTL QUOTATION_#PO150034 #SGSA420  TW23032026.pdf(105KB).com 2026-09-28 3
file sample f3148c42747ad5d0908dca44309881e9ffda509872db2cb8a2ba24c294b45660 2026-09-28 3
file sample f8583fe7094e3147b963e2199551bf4d9c1544d0f863f2fa63d4f16facc4c525 2026-09-28 1
file sample jaffacakes118_3e3ab1103fd7338b3bced16ee8d7d29f5d827e67e6d23d887e5078a5e6da6370.bin 2026-09-27 1
file sample COTIZACIÓN METALINSPEC.exe 2026-09-23 3
file sample COTIZACION.exe 2026-09-21 3
file sample BL-Draft_Loading-Shipment.exe 2026-09-20 2
file sample SOLICITUD DE COTIZACION.exe 2026-09-18 3

Detection coverage

  • 583 Sigma rules

Malware & tools used

  • Ingress Tool Transfer (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • Dynamic-link Library Injection (attack-pattern)
  • Spearphishing Attachment (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Winlogon Helper DLL (attack-pattern)
  • Time Based Checks (attack-pattern)
  • COR_PROFILER (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Masquerading (attack-pattern)
  • Hide Artifacts (attack-pattern)
  • System Checks (attack-pattern)
  • Clipboard Data (attack-pattern)
  • Keylogging (attack-pattern)
  • Malicious File (attack-pattern)
  • Process Discovery (attack-pattern)
  • Internet Connection Discovery (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Native API (attack-pattern)
  • Web Service (attack-pattern)
  • System Service Discovery (attack-pattern)
  • Component Object Model (attack-pattern)

Reports & references

  • MITRE ATT&CK — S1066 (report)
  • secureworks.com — Darktortilla Malware Analysis (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Darktortilla (report)

External references