kaandemir993/DarkTortilla-RAT-Telegram-Exfiltration-Payload-Extraction-Analysis

What it is

A reverse-engineering writeup of a DarkTortilla RAT sample (from MalwareBazaar) that, beyond the theft capabilities the summary lists, hands the reader a set of concrete host- and network-level indicators and detection ideas. The value here is the IOCs and detection guidance the summary does not carry.

Indicators the summary omits

• Local staging file: C:\Users\Public\strEncodedData.txt holds stolen credentials before exfiltration — a concrete artifact to hunt for on disk.
• SMTP exfil host: mail.mfcgroups.com, used with CDO.Message, smtpserver, sendusername, sendpassword.
• Telegram exfil: https://api.telegram.org/bot with placeholder config tokens @StrBotToken and @ChatID; FTP uses @GateUrl and @StrFtpUser.
• Script/macro fingerprints: VBA functions __vbaResume, __vbaAryVar, __vbaPutOwner4, plus VBScript markers Option Explicit / On Error Resume Next — indicating macro-borne delivery and script-based execution.
• Email harvesting regex: [A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,6}.

What to do

The page states these defensive actions directly:

• Block C2 / exfil domains: showip.net and api.telegram.org (the latter only where its use is abusive).
• Monitor for embedded Telegram bot config strings (@StrBotToken, @ChatID).
• Detect SQLite API usage (sqlite3_open, sqlite3_prepare_v2) inside suspicious processes — the malware queries browser Login Data files this way.
• Alert on access to Chrome/Edge key material app_bound_encrypted_key and os_crypt, which the RAT uses to decrypt saved passwords.
• Hunt for the staging file C:\Users\Public\strEncodedData.txt.

Caveats

This is one analyst's static/dynamic walkthrough (Process Hacker, Binary Ninja, x64dbg) of a single sample, not a vendor report. Config values like the Telegram token and @GateUrl appear as template placeholders, so per-campaign values will differ; the durable indicators are the file path, SMTP host, API-string patterns, and behavioral detections above rather than any one credential.