Before and after this time period, the encoded core processes had been stored within the resources of DarkTortilla's initial loader executable."ĬTU researchers have also seen minor changes made to the core processor DLL, including certain property names associated with parsing of DarkTortilla's configuration, he said. "Specifically, from roughly May 2021 to December 2021, DarkTortilla's initial loader had been changed to retrieve its encoded core processor from public paste sites. "We know that the crypter is being actively developed given variations that we've seen with the initial loader," Pantazopoulos said. NET resources.ĭespite being around for so long, DarkTortilla is still evolving. During those 16 months, there was an average of 93 unique DarkTortilla samples a week.Ĭode similarities seen in DarkTortilla suggests possible links with other malware, including a crypter last updated in 2016 and run by the RATs Crew threat group, which was active between 20, as well as Gameloader, malware that emerged last year and uses similar malicious spam lures and also leverages. In 365-day "retrohunts" in VirusTotal of a popular commodity malware family, CTU tends to see a couple of hundred up to 2,000 or so hits.
Crypter software code#
The number of DarkTortilla code samples loaded into VirusTotal between January 2021 and May 2022 is significantly higher than Pantazopoulos normally sees. "As a result, the threat actors and corresponding payloads associated with the crypter will vary wildly." "Though we have yet to identify how and where this crypter is being sold, we suspect that it is being sold as a service," he said. The broad array of malware that it delivers gives CTU researchers a hint of how it's being used by cybercriminals, according to Pantazopoulos. The core processor then injects and executes the configured main payload and implements its anti-tamper controls. It can also display the fake message box, checks for VMs and sandboxes, implements persistence, and processes add-on packages. The initial loader decodes, loads, and executes the core processor, which then extracts, decrypts, and parses its configuration. NET-base DLL as the core processor – needed to launch the malicious payloads. NET-based executable as the initial loader and a. More research is needed to further confirm any links.ĭarkTortilla includes two components – a. NET connection, an elaborate configuration, the ability to display a custom message box to the victim and anti-virtual machine and sandbox checks. NET encrypter that he said probably was an earlier instance of DarkTortilla based on some shared characteristics, including its. MalwareBytes researchers also put out a report in 2015 about a new. 1,900 Signal users exposed: Twilio attacker 'explicitly' looked for certain numbers.
Mozilla finds 18 of 25 popular reproductive health apps leak data.
Rob Pantazopoulos, senior security researcher with the CTU, told The Register that it's unusual for malware like DarkTortilla to be active for so long and not be detected, but that it was helped by being among a number of generic.
0 kommentar(er)
