MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54a49d9771307f97f1cdcdb468e4a38adebe3f42678a3ad178feab614f2b5bee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkTortilla


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54a49d9771307f97f1cdcdb468e4a38adebe3f42678a3ad178feab614f2b5bee
SHA3-384 hash: 7db585b882dba150e3906d13468d59e14cb635931c2698dc5fa0b923b0a4c9913613b0afdac319db5f4a7157a4ac3cd6
SHA1 hash: 9cc8f27638469624545219535b75351e93cbec2c
MD5 hash: a3d3d4bf23539d99f124c2afc6484ad6
humanhash: georgia-timing-bulldog-nitrogen
File name:Dolphin 06_Q88 V6 (Oil and Chemical)_02Jul2026.exe
Download: download sample
Signature DarkTortilla
Create hunting rule
File size:1'106'432 bytes
First seen:2026-07-13 06:06:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'116 x AgentTesla, 20'118 x Formbook, 12'357 x SnakeKeylogger)
ssdeep 24576:hNwUS2UxAPqGcv/+Duyx46QoDPHD/Sfn:hN7+qPRcvEFQoDP8
Threatray 29 similar samples on MalwareBazaar
TLSH T16D35F0259DCB5A14CB3D4A78C1A6189823F0D613C32BE76F3EF9A1F48F96B856D17042
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter threatcat_ch
Tags:DarkTortilla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
195
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
DeepSea
Details
Link:
https://research.acce.ciphertechsolutions.com/results/24abe0d6-cab1-4256-9ce6-34ec8ce17778/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/74399/
Detection(s):
SecuriteInfo.com.Variant.MSILHeracles.248145.83834976.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a54807b737be7d52c91ac08
Tags:
trojan micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Running batch commands
Launching a process
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/6a54807743ce97957bf45c88/reports/39342205-f42e-4edb-a399-7f67ba0011e7/overview
Verdict:
Malicious
Labled as:
MSILHeracles.Generic
Link:
https://www.hybrid-analysis.com/sample/54a49d9771307f97f1cdcdb468e4a38adebe3f42678a3ad178feab614f2b5bee
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-13T02:29:00Z UTC
Last seen:
2026-07-15T04:38:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/54a49d9771307f97f1cdcdb468e4a38adebe3f42678a3ad178feab614f2b5bee/results?tab=lookup
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c1d93ace-e586-4882-ae08-be6a516c9bbc
Result
Threat name:
DarkTortilla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1941334
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected AntiVM3
Yara detected DarkTortilla Crypter
Yara detected MSIL Injector
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1941334 Sample: Dolphin 06_Q88 V6 (Oil and ... Startdate: 13/07/2026 Architecture: WINDOWS Score: 100 40 Multi AV Scanner detection for submitted file 2->40 42 Yara detected MSIL Injector 2->42 44 Yara detected DarkTortilla Crypter 2->44 46 5 other signatures 2->46 7 Dolphin 06_Q88 V6 (Oil and Chemical)_02Jul2026.exe 3 2->7         started        process3 file4 32 Dolphin 06_Q88 V6 ...)_02Jul2026.exe.log, ASCII 7->32 dropped 10 cmd.exe 3 7->10         started        14 cmd.exe 1 7->14         started        process5 file6 34 C:\Users\user\AppData\Roaming\Pdf.exe, PE32 10->34 dropped 48 Uses ping.exe to sleep 10->48 16 Pdf.exe 2 10->16         started        19 conhost.exe 10->19         started        21 PING.EXE 1 10->21         started        23 PING.EXE 1 10->23         started        50 Uses ping.exe to check the status of other devices and networks 14->50 25 PING.EXE 1 14->25         started        28 conhost.exe 14->28         started        30 reg.exe 1 1 14->30         started        signatures7 process8 dnsIp9 38 Multi AV Scanner detection for dropped file 16->38 36 127.0.0.1 unknown unknown 25->36 signatures10
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/54a49d9771307f97f1cdcdb468e4a38adebe3f42678a3ad178feab614f2b5bee
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.84 Win 32 Exe x86
Link:
https://app.malva.re/file/a3d3d4bf23539d99f124c2afc6484ad6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/54a49d9771307f97f1cdcdb468e4a38adebe3f42678a3ad178feab614f2b5bee/
Threat name:
Win32.Trojan.MsilHrcls
Create hunting rule
Status:
Malicious
First seen:
2026-07-13 05:26:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
25
AV detection:
21 of 37 (56.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kssj3f3rgb7zp4onzw2grzfdrlpl4p2cm6fdvuly72vwctzllpxa._file
Verdict:
malicious
Label(s):
sorano
Create hunting rule
formbook
Create hunting rule
Similar samples:
4e8f402951511d7d3b90b0aa4dac332f1c4df89a032cd773c30374cee5b9d8a0
DarkTortilla
54a49d9771307f97f1cdcdb468e4a38adebe3f42678a3ad178feab614f2b5bee
DarkTortilla
5b24980d605b28c0863016aa90f67ccad03fc86f872896b031aa28f7e6e6072b
DarkTortilla
69698e5df2e1522285714141e20a245ec914a4ecdd71ce216e06210bec8107ce
DarkTortilla
aa87d302ef084bc37bdd794fb1f7c600fd438e132e5dd8f51865ef475c7b9a43
DarkTortilla
error
DarkTortilla
+ 19 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/260713-gt6adsct9q/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Adds Run key to start application
.NET Reactor proctector
Executes dropped EXE
Unpacked files
SH256 hash:
54a49d9771307f97f1cdcdb468e4a38adebe3f42678a3ad178feab614f2b5bee
MD5 hash:
a3d3d4bf23539d99f124c2afc6484ad6
SHA1 hash:
9cc8f27638469624545219535b75351e93cbec2c
Link:
https://www.unpac.me/results/b1bf0ff5-e024-4677-8019-f3c69553f654/
SH256 hash:
0560dc3341dfec3c62eb46b34f35a49aadefcf32c998278d5a30217ef3a0ea9b
MD5 hash:
54cc82f466f7bf3e13d5cc2921758beb
SHA1 hash:
579fbd3c06299322c8d54f79473230b684b123d8
Link:
https://www.unpac.me/results/b1bf0ff5-e024-4677-8019-f3c69553f654/
SH256 hash:
0a17fd43cedc74a89d2ba5078cfa9bc8fe1c8557f49ef1e3415d68b57aaa5b59
MD5 hash:
03fe84c8fd2f0af1e75acc8ca52c2f86
SHA1 hash:
b162f1706513fd595585acebbee54321e8773333
Link:
https://www.unpac.me/results/b1bf0ff5-e024-4677-8019-f3c69553f654/
SH256 hash:
961b103dab92ad48cd2cee250f89a57e7b3dbf202bd68049e2419f69ed8b8fdf
MD5 hash:
54e8511cc2054599b82ddd519e37a3c0
SHA1 hash:
25784b502faf98c49e9002d3f5d3c3db9f17d7f8
Link:
https://www.unpac.me/results/b1bf0ff5-e024-4677-8019-f3c69553f654/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/54a49d977130/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/54a49d9771307f97f1cdcdb468e4a38adebe3f42678a3ad178feab614f2b5bee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkTortilla

Executable exe 54a49d9771307f97f1cdcdb468e4a38adebe3f42678a3ad178feab614f2b5bee

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/74399/

Comments