Procedure examples

DarkTortilla can retrieve information about a compromised system's running services.

DarkTortilla can check for internet connectivity by issuing HTTP GET requests.

DarkTortilla has been obfuscated with the DeepSea .NET and ConfuserEx code obfuscators.

DarkTortilla's payload has been renamed `PowerShellInfo.exe`.

DarkTortilla can use WMI queries to obtain system information.

DarkTortilla can use a .NET-based DLL named `RunPe6` for process injection.

DarkTortilla can download a keylogging module.

DarkTortilla can enumerate a list of running processes on a compromised system.

DarkTortilla can use `cmd.exe` to add registry keys for persistence.

DarkTortilla has used HTTP and HTTPS for C2.

DarkTortilla can obtain system information by querying the `Win32_ComputerSystem`, `Win32_BIOS`, `Win32_MotherboardDevice`, `Win32_PnPEntity`, and `Win32_DiskDrive` WMI objects.

DarkTortilla can retrieve its primary payload from public sites such as Pastebin and Textbin.

DarkTortilla can download additional packages for keylogging, cryptocurrency mining, and other capabilities; it can also retrieve malicious payloads such as Agent Tesla, AsyncRat, NanoCore, RedLine, Cobalt Strike, and Metasploit.

DarkTortilla can use a variety of API calls for persistence and defense evasion.

DarkTortilla has modified registry keys for persistence.

DarkTortilla can download a clipboard information stealer module.

DarkTortilla can decrypt its payload and associated configuration elements using the Rijndael cipher.

DarkTortilla has relied on a user to open a malicious document or archived file delivered via email for initial execution.

DarkTortilla can search a compromised system's running processes and services to detect Hyper-V, QEMU, Virtual PC, Virtual Box, and VMware, as well as Sandboxie.

DarkTortilla can implement the `kernel32.dll` Sleep function to delay execution for up to 300 seconds before implementing persistence or processing an addon package.

DarkTortilla can check for the Kaspersky Anti-Virus suite.

DarkTortilla has established persistence via the `Software\Microsoft\Windows NT\CurrentVersion\Run` registry key and by creating a .lnk shortcut file in the Windows startup folder.

DarkTortilla has established persistence via the `Software\Microsoft\Windows NT\CurrentVersion\Winlogon` registry key.

DarkTortilla has used the `WshShortcut` COM object to create a .lnk shortcut file in the Windows startup folder.

DarkTortilla has used `%HiddenReg%` and `%HiddenKey%` as part of its persistence via the Windows registry.

DarkTortilla has been distributed via spearphishing emails containing archive attachments, with file types such as .iso, .zip, .img, .dmg, and .tar, as well as through malicious documents.

DarkTortilla can detect profilers by verifying the `COR_ENABLE_PROFILING` environment variable is present and active.

DarkTortilla can detect debuggers by using functions such as `DebuggerIsAttached` and `DebuggerIsLogging`. DarkTortilla can also detect profilers by verifying the `COR_ENABLE_PROFILING` environment variable is present and active.