DarkTortilla-RAT-Telegram-Exfiltration-Payload-Extraction-Analysis

1. Credit Card Theft – Card Data Extraction

Process Hacker memory analysis reveals that DarkTortilla RAT targets credit card information, including card numbers, expiration dates, and card types.

Key Strings Observed:

• card_number_encrypted – Encrypted card numbers.
• expiration_month – Expiration month.
• expiration_year – Expiration year.
• Mastercard – Targets Mastercard cards.
• Visa – Targets Visa cards.
• Discover Card – Targets Discover cards.
• Union Pay Card – Targets Union Pay cards.
• American Express – Targets American Express cards.

Why This Matters:

• Financial Data Theft: The malware steals credit card information.
• Encryption: card_number_encrypted suggests the data is encrypted before exfiltration.
• Wide Range: Supports multiple card types (Visa, Mastercard, Discover, Union Pay, Amex).

Visual Reference:

Process Hacker view showing credit card-related strings (card_number_encrypted, Mastercard, Visa, etc.).

2. Browser Data Theft & C2 Address (Binary Ninja)

Binary Ninja analysis of the extracted .bin file reveals that DarkTortilla RAT targets browser profiles and uses showip.net as a C2 address.

Key Observations:

• Browser Profiles: Targets Chrome, Edge, Firefox, Brave, Opera, and many other browsers.
• C2 Address: showip.net – likely used for IP detection and C2 communication.
• Email Regex: [A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,6} – for extracting email addresses.
• VBA Functions: __vbaResume, __vbaAryVar, __vbaPutOwner4 – indicates VBA/macro usage (potential phishing).

Why This Matters:

• Data Theft: Steals browser profiles (cookies, passwords, history).
• C2 Communication: showip.net is used to detect the victim's IP.
• Email Extraction: The regex is used to extract email addresses from stolen data.

Visual Reference:

Binary Ninja view showing browser profile paths and showip.net C2 address.

3. Browser Decryption & Data Storage

Binary Ninja analysis reveals that DarkTortilla RAT targets browser encryption keys and stores stolen data in encoded files.

Key Observations:

• Browser Paths: Targets Chrome, Edge, Brave, and Avast Browser.
• Encryption Keys: app_bound_encrypted_key and os_crypt – used to decrypt saved passwords.
• Stored Data: C:\Users\Public\strEncodedData.txt – likely contains stolen credentials.
• VBScript Code: Option Explicit, On Error Resume Next – indicates VBScript usage for persistence or execution.

Why This Matters:

• Password Decryption: Extracts and uses browser encryption keys to decrypt saved passwords.
• Data Storage: Stolen data is saved to a file for later exfiltration.
• Wide Target: Supports multiple browsers (Chrome, Edge, Brave, Avast).

Visual Reference:

Binary Ninja view showing browser paths, encryption keys (app_bound_encrypted_key), and strEncodedData.txt.

4. SQLite Database & Card Data Extraction

Process Hacker strins analysis reveals that DarkTortilla RAT uses SQLite databases to extract browser credentials and credit card information.

Key Observations:

• Login Data: Targets browser Login Data files (passwords).
• SQLite Functions: sqlite3_open, sqlite3_prepare_v2, sqlite3_step – used to query databases.
• Card Types: Adds Carte Blanche Card and Diners Club Card to the target list.
• Output: Extracts name_on_card, expiration_*, card_number.

Why This Matters:

• Credential Theft: Extracts saved passwords from browsers.
• SQLite Usage: Allows the malware to read structured data (SQLite databases).
• Wide Coverage: Supports multiple card types (Visa, Mastercard, Amex, Diners Club, Carte Blanche).

Visual Reference:

Binary Ninja view showing SQLite functions and card-related strings (Carte Blanche Card, Diners Club Card).

5. Telegram, SMTP & FTP Exfiltration

Binary Ninja analysis reveals that DarkTortilla RAT uses multiple exfiltration channels: Telegram Bot, SMTP (email), and FTP.

Key Observations:

• Telegram Bot: https://api.telegram.org/bot with @StrBotToken and @ChatID – sends stolen data via Telegram.
• SMTP (Email): CDO.Message, mail.mfcgroups.com, smtpserver, sendusername, sendpassword – sends data via email.
• FTP: @GateUrl, @StrFtpUser – uploads data via FTP.

Why This Matters:

• Multiple Exfiltration Channels: Ensures data is sent even if one channel is blocked.
• Telegram: Real-time notification and data delivery.
• Email & FTP: Traditional exfiltration methods for larger files.

Visual Reference:

Binary Ninja view showing Telegram bot token, SMTP settings, and FTP-related strings.

Conclusion

This analysis uncovered DarkTortilla RAT, a sophisticated Remote Access Trojan that combines extensive data theft capabilities with multiple exfiltration channels.

Key Takeaways:

• Credit Card Theft: Targets card numbers, expiration dates, and supports 10+ card types (Visa, Mastercard, Amex, Diners Club, etc.).
• Browser Data Theft: Steals passwords, cookies, and profiles from 20+ browsers (Chrome, Edge, Firefox, Brave, Opera, etc.).
• Encryption Bypass: Uses app_bound_encrypted_key and os_crypt to decrypt Chrome/Edge passwords.
• SQLite Database: Extracts structured data from browser Login Data files.
• Exfiltration: Sends stolen data via Telegram Bot, SMTP (email), and FTP.
• C2 Address: showip.net – used for IP detection and C2 communication.

Detection Recommendations:

• Block C2 domains: showip.net, api.telegram.org (if abused).
• Monitor for Telegram Bot tokens (@StrBotToken, @ChatID).
• Detect SQLite function usage (sqlite3_open, sqlite3_prepare_v2) in suspicious processes.
• Monitor for app_bound_encrypted_key and os_crypt access.

Sample Download

The analyzed DarkTortilla RAT sample is available on MalwareBazaar for those who wish to conduct their own analysis:

🔗 DarkTortilla RAT Sample on MalwareBazaar

Tools Used: Process Hacker, Binary Ninja, x64dbg