Researchers Detail Evasive DarkTortilla Crypter Used to Deliver Malware

A .NET-based evasive crypter named DarkTortilla
has been used by threat actors to distribute a broad array of
commodity malware as well as targeted payloads like Cobalt Strike
and Metasploit, likely since 2015^[1].

“It can also deliver ‘add-on packages’ such as additional
malicious payloads, benign decoy documents, and executables,”
cybersecurity firm Secureworks said^[2]
in a Wednesday report. “It features robust anti-analysis and
anti-tamper controls that can make detection, analysis, and
eradication challenging.”

Malware delivered by the crypter includes information steakers
and remote access trojans (RATs) such as Agent Tesla, AsyncRat,
NanoCore, and RedLine Stealer. “DarkTortilla has versatility that
similar malware does not,” the researchers noted.

Crypters are software tools^[3]
that use a combination^[4]
of encryption, obfuscation, and code manipulation of malware so as
to bypass detection^[5]
by security solutions.

The delivery of DarkTortilla occurs via malicious spam emails
which contain archives with an executable for an initial loader
that’s used to decode and launch a core processor module either
embedded within itself or fetched from text storage sites such as
Pastebin.

The core processor is then responsible for establishing
persistence and injecting the primary RAT payload into memory
without leaving a trail on the file system through an elaborate
configuration file that also allows it to drop add-on packages,
including keyloggers, clipboard stealers, and cryptocurrency
miners.

DarkTortilla is further noteworthy for its use of anti-tamper
controls that ensure both the processes used to execute the
components in memory are immediately rerun upon termination.

Specifically, the persistence of the initial loader is achieved
by means of a second executable referred to as a WatchDog that’s
designed to keep tabs on the designated process and rerun it should
it be killed.

This technique is reminiscent of a similar mechanism adopted by
a threat actor called Moses Staff^[6], which, earlier this
year, was found relying on a watchdog-based approach to prevent any
interruption to its payloads. Also employed are two other controls
to guarantee the continued execution of the dropped WatchDog
executable itself and the persistence for the initial loader.

Secureworks said it identified an average of 93 unique
DarkTortilla samples being uploaded to the VirusTotal malware
database per week over a 17-month period from January 2021 to May
2022.

“DarkTortilla is capable of evading detection, is highly
configurable, and delivers a wide range of popular and effective
malware,” the researchers concluded. “Its capabilities and
prevalence make it a formidable threat.”