DarkTortilla

Family profile

DarkTortilla is a Windows malware family/loader distributed primarily through spearphishing emails containing archive attachments such as .iso, .zip, .img, .dmg, and .tar, as well as malicious documents. Initial execution relies on user interaction to open the malicious document or archived file delivered via email. Observed capabilities include persistence through registry key modification and creation of a .lnk shortcut in the Windows Startup folder via the WshShortcut COM object; system discovery using WMI queries to obtain system information; retrieval of information about running services; security software discovery, including checks for Kaspersky Anti-Virus; internet connectivity checks via HTTP GET requests; retrieval of its primary payload from public sites such as Pastebin and Textbin; modular payload delivery including clipboard information stealer and keylogging modules; process injection using a .NET-based DLL named RunPe6; and anti-analysis checks that detect debuggers using DebuggerIsAttached and DebuggerIsLogging and detect profilers by verifying whether the COR_ENABLE_PROFILING environment variable is present and active. A reported masquerading behavior is renaming its payload to PowerShellInfo.exe.

MITRE ATT&CK

DarkTortilla in ATT&CK

32 distinct techniques

Techniques

32 techniques

T1547.009 Shortcut Modification T1082 System Information Discovery T1518.001 Security Software Discovery T1547.001 Registry Run Keys / Startup Folder T1112 Modify Registry T1204.002 Malicious File T1071.001 Web Protocols T1115 Clipboard Data T1140 Deobfuscate/Decode Files or Information T1057 Process Discovery T1059.003 Windows Command Shell T1047 Windows Management Instrumentation T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information T1204 User Execution T1547 Boot or Logon Autostart Execution T1049 System Network Connections Discovery T1007 System Service Discovery T1105 Ingress Tool Transfer T1559.001 Component Object Model T1574.012 COR_PROFILER T1564 Hide Artifacts T1497.003 Time Based Checks T1622 Debugger Evasion T1016.001 Internet Connection Discovery T1497.001 System Checks T1102 Web Service T1547.004 Winlogon Helper DLL T1056.001 Keylogging T1055.001 Dynamic-link Library Injection T1106 Native API T1036 Masquerading

Reporting

Research mentioning DarkTortilla

Jul 15

Esentire

DinDoor, DenoRAT, and NightshadeC2: Analyzing TAG-150's Evolving Tradecraft | eSentire

eSentire reported that a June 2026 intrusion against a finance-sector customer began with a ClickFix-style social engineering lure that triggered a malicious command, an MSI installer, and a multi-stage malware chain attributed to TAG-150. The infection sequence used an apparently AI-generated PowerShell script, Griffin20.ps1, to install the Deno runtime and launch the Deno-based loader DinDoor, which then deployed DenoRAT and ultimately NightshadeC2. Investigators said the malware communicated with command-and-control infrastructure including webstizkgao[.]com and used hard-coded JWTs carrying campaign identifiers such as buildId 0def066f14754be9 and buildNote LearnV7msi. The tooling provided broad post-compromise capability, with DenoRAT functioning as a RAT, loader, and stealer that supported command execution, persistence, host fingerprinting, file operations, screenshots, PTY and VNC-style remote control, and theft from browsers and cryptocurrency wallets. eSentire said the malware could also bypass Chromium App-Bound Encryption through DLL injection, a technique widely associated with in-memory execution, evasion, and abuse of legitimate Windows processes in ATT&CK T1055.001. The final NightshadeC2 payload was delivered through a PowerShell-driven Python in-memory loader, decrypted from an encrypted container using AES-256-CBC with a key derived from MoscauHighSmoke, and reflectively mapped into a Python process before the affected host was isolated and remediated.