Researchers from Secureworks Counter Threat Unit (CTU) released a report detailing a malware they have been tracking since January 2021. Dubbed “DarkTortilla”, the malware is a “complex and configurable .NET-based crypter” that has been active since at least August 2015. Crypters are malware that use encryption, obfuscation, and code manipulation to evade detection software and drop other malware. DarkTortilla delivers popular information stealers and remote access trojan malware such as “AgentTesla”, “AsyncRat”, “NanoCore”, and “RedLine Stealer” and has been known to drop ransomware in some cases. DarkTortilla has been observed being deployed using malicious spam campaigns. The phishing emails typically use a logistics lure and includes the malicious payload in a malicious document or an archived attachment with the file types .iso, .zip, .img, .dmg, and .tar. The CTU researchers discovered emails written in multiple languages including English, German, Romanian, Spanish, Italian, and Bulgarian. When a victim executes the initial payload, DarkTortilla grabs the “core processor” from a public paste site. This core processor provides the main functionality for the malware such as establishing persistence and injecting the dropped malware into memory. CTU researchers identified ninety-three (93) unique DarkTortilla samples out of the 10,000 total samples; only nine (9) of the samples were used to drop ransomware. The researchers were unable to determine where or how DarkTortilla is being sold. CTIX analysts are continuing to monitor this malware and will provide updates for new developments.