MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f4a7d9028089b7be46f98d664878d01cf67238d25bdfd7daf17c2a4f5d0d726. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkTortilla


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f4a7d9028089b7be46f98d664878d01cf67238d25bdfd7daf17c2a4f5d0d726
SHA3-384 hash: bd592f4087f331a0b61b050fece6d414c0593e647e4b23a7ed400121079c8d3d674484c2541bdcf482d516b3b66213ec
SHA1 hash: bd9618982b3e46fd2a38e9160b3f0c68287275ff
MD5 hash: 17a843e8c37adbd73553d85dfbd3b677
humanhash: east-oxygen-california-artist
File name:file
Download: download sample
Signature DarkTortilla
Create hunting rule
File size:1'288'704 bytes
First seen:2025-12-28 04:53:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:fDW+m8n14qO94Jy/da6BoQR5QUv/pzgCtusyz9Ly1v:frnBy/dzBXVv9xuthy1
Threatray 1 similar samples on MalwareBazaar
TLSH T1F255E06123F81A58F1BFAF794475995007F2F84BEA32E30D6A4950ED4C71B81DA62B33
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter Bitsight
Tags:DarkTortilla dropped-by-amadey exe fbf543


Avatar
Bitsight
url: http://130.12.180.43/files/454503574/wTWAYUx.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2025-12-28 04:55:59 UTC
Tags:
netreactor auto-reg auto-startup
Link:
https://app.any.run/tasks/4458ed1c-9fdb-4584-a619-55632770741a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46257/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6950b7f74503237b77fbe281
Tags:
autorun shell msil sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypt darkcloud lolbin obfuscated obfuscated tracker unsafe vbnet
Link:
https://www.filescan.io/uploads/6950b7f5e126b9ff4393a66c/reports/f61f0fbd-44c5-4a7e-941a-d86ca9300bcb/overview
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/5f4a7d9028089b7be46f98d664878d01cf67238d25bdfd7daf17c2a4f5d0d726
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-28T02:07:00Z UTC
Last seen:
2025-12-28T03:45:00Z UTC
Hits:
~10
Detections:
PDM:Trojan.Win32.Generic HEUR:Trojan.MSIL.Mucc.gen Trojan.Win32.Mucc.sb Trojan.Win32.Agent.sb Trojan.MSIL.Inject.b Trojan.MSIL.Agent.sb
Link:
https://opentip.kaspersky.com/5f4a7d9028089b7be46f98d664878d01cf67238d25bdfd7daf17c2a4f5d0d726/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/241efcf6-92ef-48f5-af6a-abd176c1b4da
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5f4a7d9028089b7be46f98d664878d01cf67238d25bdfd7daf17c2a4f5d0d726
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.85 Win 32 Exe x86
Link:
https://app.malva.re/file/17a843e8c37adbd73553d85dfbd3b677
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f4a7d9028089b7be46f98d664878d01cf67238d25bdfd7daf17c2a4f5d0d726/
Verdict:
Malicious
Threat:
Trojan.Win32.Inject
Link:
https://tip.neiki.dev/file/5f4a7d9028089b7be46f98d664878d01cf67238d25bdfd7daf17c2a4f5d0d726
Threat name:
ByteCode-MSIL.Trojan.Zilla
Create hunting rule
Status:
Malicious
First seen:
2025-12-28 04:54:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
43
AV detection:
14 of 36 (38.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l5fh3ebibcnxxzdptdlgjb4nahhwoi4new6727npc7bkj5oq24ta._file
Verdict:
malicious
Label(s):
unc_loader_078
Create hunting rule
Similar samples:
5f4a7d9028089b7be46f98d664878d01cf67238d25bdfd7daf17c2a4f5d0d726
DarkTortilla
error
DarkTortilla
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/251228-fjmjvszqfm/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Adds Run key to start application
.NET Reactor proctector
Drops startup file
Executes dropped EXE
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8bc4d760-ac79-46e8-904c-0d7d7b174dd6
Unpacked files
SH256 hash:
5f4a7d9028089b7be46f98d664878d01cf67238d25bdfd7daf17c2a4f5d0d726
MD5 hash:
17a843e8c37adbd73553d85dfbd3b677
SHA1 hash:
bd9618982b3e46fd2a38e9160b3f0c68287275ff
Link:
https://www.unpac.me/results/8e58f686-b502-402c-800f-6e12b872ca22/
SH256 hash:
d22acaba9a469978cbc576082ac3df233696a6b1540d92290c10485b8c9d208b
MD5 hash:
60e238583abe523d6a42a5d213a3e502
SHA1 hash:
5823bbf37f042fe2afda8ff0109089019de5b6c4
Link:
https://www.unpac.me/results/8e58f686-b502-402c-800f-6e12b872ca22/
SH256 hash:
2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
MD5 hash:
0e362e7005823d0bec3719b902ed6d62
SHA1 hash:
590d860b909804349e0cdc2f1662b37bd62f7463
Link:
https://www.unpac.me/results/8e58f686-b502-402c-800f-6e12b872ca22/
SH256 hash:
d1cf46d72ba82426cc92bc0be80220d462286fb5e1791fb04adaa8950c0bd238
MD5 hash:
a2b3f41d3eb6e5107015e1a7a36335ba
SHA1 hash:
6cd09f228e9c9ed161d89e0994e6ec6133cf6c0b
Link:
https://www.unpac.me/results/8e58f686-b502-402c-800f-6e12b872ca22/
SH256 hash:
07cefe40a185afd840d138acb90a344a477e21bc24dbf50ca1a11478d31a66b5
MD5 hash:
35790dc0f15a083a3e1b0d06e734b80a
SHA1 hash:
d03bfe9ae9f31061f5ade04f2fe15fd583cce655
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Link:
https://www.unpac.me/results/8e58f686-b502-402c-800f-6e12b872ca22/
Parent samples :
1c0a6d90e8b34ef3b8406be47df82bccc16a1811ea3762cf5951b1a1f3ac02c3
6bf81a58f47093727e85a5175d3b7042384159ce7088fa94b4476bda09ea401e
5f4a7d9028089b7be46f98d664878d01cf67238d25bdfd7daf17c2a4f5d0d726
aa1a6d2e36e59f92605e0e5b2de31ffa7b02af80ffc15cad7c9f409dbdf08d27
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5f4a7d902808/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5f4a7d9028089b7be46f98d664878d01cf67238d25bdfd7daf17c2a4f5d0d726

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkTortilla

Executable exe 5f4a7d9028089b7be46f98d664878d01cf67238d25bdfd7daf17c2a4f5d0d726

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3745097/
Cape
Cape
https://www.capesandbox.com/analysis/46257/

Comments