MITRE ATT&CKsoftware (malware)

S1066 DarkTortilla

Published 2023-02-16 Modified 2025-04-16 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2023-02-16

Description

DarkTortilla is a highly configurable .NET-based crypter that has been possibly active since at least August 2015. DarkTortilla has been used to deliver popular information stealers, RATs, and payloads such as Agent Tesla, AsyncRat, NanoCore, RedLine, Cobalt Strike, and Metasploit.

Related

Uses · MITRE ATT&CK (28)

  • T1622 Debugger Evasion technique
  • T1016.001 Internet Connection Discovery sub-technique
  • T1574.012 COR_PROFILER sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1497.001 System Checks sub-technique
  • T1497.003 Time Based Checks sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1564 Hide Artifacts technique
  • T1518.001 Security Software Discovery sub-technique
  • T1559.001 Component Object Model sub-technique
  • T1056.001 Keylogging sub-technique
  • T1547.004 Winlogon Helper DLL sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1055.001 Dynamic-link Library Injection sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1007 System Service Discovery technique
  • T1027 Obfuscated Files or Information technique
  • T1036 Masquerading technique
  • T1047 Windows Management Instrumentation technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1102 Web Service technique
  • T1105 Ingress Tool Transfer technique
  • T1106 Native API technique
  • T1112 Modify Registry technique
  • T1115 Clipboard Data technique

References