Threat intelligence / Malware

DarkTortilla

[DarkTortilla](https://attack.mitre.org/software/S1066) is a highly configurable .NET-based crypter that has been possibly active since at least August 2015. [DarkTortilla](https://attack.mitre.org/software/S1066) has been used to deliver popular information stealers, RATs, and payloads such as [Agent Tesla](https://attack.mitre.org/software/S0331), AsyncRat, [NanoCore](https://attack.mitre.org/software/S0336), RedLine, [Cobalt Strike](https://attack.mitre.org/software/S0154), and Metasploit.(Citation: Secureworks DarkTortilla Aug 2022)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[DarkTortilla](https://attack.mitre.org/software/S1066) is a highly configurable .NET-based crypter that has been possibly active since at least August 2015. [DarkTortilla](https://attack.mitre.org/software/S1066) has been used to deliver popular information stealers, RATs, and payloads such as [Agent Tesla](https://attack.mitre.org/software/S0331), AsyncRat, [NanoCore](https://attack.mitre.org/software/S0336), RedLine, [Cobalt Strike](https://attack.mitre.org/software/S0154), and Metasploit.(Citation: Secureworks DarkTortilla Aug 2022)

Labels

malware

28 recorded

Relationships

uses

to Clipboard Data

Technique

uses

to Component Object Model

Technique

uses

to COR_PROFILER

Technique

uses

to Debugger Evasion

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to Hide Artifacts

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Internet Connection Discovery

Technique

uses

Technique

uses

to Malicious File

Technique

uses

to Masquerading

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Security Software Discovery

Technique

uses

to Spearphishing Attachment

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Service Discovery

Technique

uses

to Time Based Checks

Technique

uses

to Web Protocols

Technique

uses

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Winlogon Helper DLL

Technique

2 external

References

mitre-attack

S1066

Secureworks DarkTortilla Aug 2022

https://www.secureworks.com/research/darktortilla-malware-analysis