MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7791be7f06e67cfb2e32c1f709b8bf8afc5f354653d1a2074a47e80d8c04ff49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkTortilla


Vendor detections: 19


Intelligence 19 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7791be7f06e67cfb2e32c1f709b8bf8afc5f354653d1a2074a47e80d8c04ff49
SHA3-384 hash: bbc1476e24d6a81227c19df894569ac04cf2276c40985435c70d0fb2b71e2a41d1147f16026c676a3814cfff56eb13e0
SHA1 hash: 88c44f87b0decd5d91759514ffa7e4abd7c42471
MD5 hash: 6434db989785abb5ce2088e34915935f
humanhash: equal-pennsylvania-winter-summer
File name:NUEVA ORDEN DE COMPRA.exe
Download: download sample
Signature DarkTortilla
Create hunting rule
File size:873'984 bytes
First seen:2026-06-25 15:52:48 UTC
Last seen:2026-06-26 05:45:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'076 x AgentTesla, 20'045 x Formbook, 12'353 x SnakeKeylogger)
ssdeep 24576:Qsgs6KOi1c8/ZwQoZntN9+mMPYldT0BrV+c3:vgLzSc8ebzN86gV
Threatray 43 similar samples on MalwareBazaar
TLSH T10605CF2559132B07C23D2F79C0372DD853FBE6424166DF277FE862E859AABC1CA47A01
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter threatcat_ch
Tags:DarkTortilla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
176
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
DeepSea
Details
Link:
https://research.acce.ciphertechsolutions.com/results/6da3e17d-2500-463a-8cb8-847034a075d5/
Malware family:
n/a
ID:
1
File name:
_7791be7f06e67cfb2e32c1f709b8bf8afc5f354653d1a2074a47e80d8c04ff49.exe
Verdict:
Suspicious activity
Analysis date:
2026-06-25 15:56:06 UTC
Tags:
netreactor
Link:
https://app.any.run/tasks/8947d883-4e7f-41a8-86e7-f7e5eaf61dfe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/71995/
Detection(s):
SecuriteInfo.com.Trojan.MSIL.Basic.8.Gen.16915719.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a3d4f061548daf709f9bf4d
Tags:
virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
lolbin obfuscated obfuscated packed tracker vbnet
Link:
https://www.filescan.io/uploads/6a3d4f01f286b0b6e710b36c/reports/79d63550-f160-4614-8790-f4afc79b2965/overview
Verdict:
Malicious
Labled as:
Trojan.MSIL.Basic.8
Link:
https://www.hybrid-analysis.com/sample/7791be7f06e67cfb2e32c1f709b8bf8afc5f354653d1a2074a47e80d8c04ff49
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-06-25T12:41:00Z UTC
Last seen:
2026-06-27T12:47:00Z UTC
Hits:
~1000
Detections:
VHO:Trojan-PSW.MSIL.Agensla.gen PDM:Trojan.Win32.Generic Backdoor.MSIL.XWorm.c Backdoor.Agent.TCP.C&C Trojan.MSIL.Inject.sb Trojan.MSIL.Inject.b Trojan.MSIL.Crypt.sb Backdoor.MSIL.XWorm.b Backdoor.MSIL.XWorm.a HEUR:Trojan-PSW.MSIL.Agensla.gen
Link:
https://opentip.kaspersky.com/7791be7f06e67cfb2e32c1f709b8bf8afc5f354653d1a2074a47e80d8c04ff49/results?tab=lookup
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/78dfc590-b654-4be6-a74d-061a7f2d3967
Result
Threat name:
DarkTortilla, XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1933813
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected DarkTortilla Crypter
Yara detected MSIL Injector
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7791be7f06e67cfb2e32c1f709b8bf8afc5f354653d1a2074a47e80d8c04ff49
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7791be7f06e67cfb2e32c1f709b8bf8afc5f354653d1a2074a47e80d8c04ff49/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/7791be7f06e67cfb2e32c1f709b8bf8afc5f354653d1a2074a47e80d8c04ff49
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-06-25 15:17:57 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o6i347yg4z6pwlrsyh3qtof7rl6f6nkgkpi2eb2ki7ua3dae75eq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
99bee9c7498d8bbf660140795ad31220000a408d8234f58bed07939779ce0ed4
DarkTortilla
b064db45193ce571396ff195824ae113a33af2ad516bfe2322ea13c9cc1ce2c4
DarkTortilla
c2a383a0dff5e69299443a119bb73f2b76f3f9c0f3951330ffea5db26fc3797f
DarkTortilla
ca0d6b04fc3b7229e6379ad31799338a552a75f9c5b160cfee4678f88a4500fc
DarkTortilla
error
DarkTortilla
+ 33 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
7791be7f06e67cfb2e32c1f709b8bf8afc5f354653d1a2074a47e80d8c04ff49
MD5 hash:
6434db989785abb5ce2088e34915935f
SHA1 hash:
88c44f87b0decd5d91759514ffa7e4abd7c42471
Link:
https://www.unpac.me/results/cec5add7-809c-452d-a1ec-c2cf90ebd135/
SH256 hash:
6b0d7f52e729599c48f7028ed11609684cb27185c8926e69f0ca1efdc4e91c87
MD5 hash:
04661edf86216dc16006137ed2863c58
SHA1 hash:
5f543faa51ed3a9b2990e328526a4524d043fc82
Link:
https://www.unpac.me/results/cec5add7-809c-452d-a1ec-c2cf90ebd135/
SH256 hash:
bc8842d3a38df3dce1b83f843c7ad6ebc8fd4b91b1ea6b16d2545af390249411
MD5 hash:
b00b82bc61f9942f95a6ebff5778ef4b
SHA1 hash:
712ec81dfde0935691a0f577e8f4cc6ac3ef5f4c
Link:
https://www.unpac.me/results/cec5add7-809c-452d-a1ec-c2cf90ebd135/
SH256 hash:
d4223c8347bb522e384fdfeb4a24195f8ba08e417517a0437a17dbd31c8c43a0
MD5 hash:
0b651836e4b96290c9f885f974113034
SHA1 hash:
9039a02dbb939ecc760d766d74d7cb2624a7df50
Detections:
win_xworm_a0
Create hunting rule
win_xworm_w0
Create hunting rule
XWorm
Create hunting rule
Link:
https://www.unpac.me/results/cec5add7-809c-452d-a1ec-c2cf90ebd135/
Parent samples :
c2a383a0dff5e69299443a119bb73f2b76f3f9c0f3951330ffea5db26fc3797f
60f29781b976a9e1d2638edb1f04333335712a572c0bcfb7d4c49eeab6dd2eb9
b4f2276d77aab7af850e2994faf1f44524a4356ed3ffea0e1ddd4e56dfb274c7
7791be7f06e67cfb2e32c1f709b8bf8afc5f354653d1a2074a47e80d8c04ff49
SH256 hash:
83388a1267b23408f6b7fb2247512525de854cb52b558c66b51b76f6066b7358
MD5 hash:
f4ba0a25c84992c0e5f4b73dc3dbf5df
SHA1 hash:
de334061c8757e5961ed8e64c60c5c1af69f5065
Link:
https://www.unpac.me/results/cec5add7-809c-452d-a1ec-c2cf90ebd135/
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7791be7f06e6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7791be7f06e67cfb2e32c1f709b8bf8afc5f354653d1a2074a47e80d8c04ff49

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkTortilla

Executable exe 7791be7f06e67cfb2e32c1f709b8bf8afc5f354653d1a2074a47e80d8c04ff49

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/71995/

Comments