Tuesday, May 13, 2025
HomeComputer SecurityDark Tequila Malware Steals Financial Information and Login Details of Popular Websites

Dark Tequila Malware Steals Financial Information and Login Details of Popular Websites

Published on

SIEM as a Service

Follow Us on Google News

Security researchers from Kaspersky uncovered a malware campaign that is active for almost Five years since from 2013. The malware campaign dubbed Dark Tequila primarily targets Mexican users.

Dark Tequila was designed to steal the financial credentials of customers associated with Mexican banking institutions and also the login credentials of the popular websites ranging from code versioning repositories to public file storage accounts and domain registrars.

Dark Tequila Malware Delivery

The malware will be delivered only if certain conditions are met. It is a multi-stage payload it checks for the system to see any security software installed or the sample is being run in an analysis environment.

Attackers use to deliver the malware through online spear-phishing and the offline infection through USB device. The threat actors behind Dark Tequila carefully monitor’s it’s activities, if any user installs the malware outside of Mexico then the attackers uninstall the malware remotely.
- Advertisement - Google News

According to researchers “The malicious implant contains all the modules required for the operation and, when instructed to do so by the command server, different modules decrypt and activate. All stolen data is uploaded to the server in encrypted form.”

Dark Tequila Modules

Module 1: Command and Control Server

It takes care of the communication between the command and control server and also it verifies that any man-in-the-middle network check is being performed to defend against analysis.

Module 2 – CleanUp

If it detects any security program or suspicious activity or likes running on a virtual machine it executes the cleanup module and performs a full cleanup of the system.

Module 3 – Advanced Keylogger

Designed to steal credentials from a list of online banking and generic sites such as Cpanel, Plesk, online flight reservation systems, Microsoft Office365, IBM Lotus Notes clients, Zimbra email, Bitbucket, Amazon, GoDaddy, Register, Namecheap, Dropbox, Softlayer, Rackspace, and other services.

Module 4 – Password Stealer

It steals the password from Email’s, FTP clients and as well as from the browsers.

Module 5 – USB Infector

It makes the malware to move offline through the victim’s network, it copies itself if the USB inserted on the affected system and get ready to spread for another machine.

Module 6 – watchdog

Monitoring service to make sure the malware is running properly.

The campaign is still active and it can be deployed to any part of the word and it can attack any targets.

Reference hashes:

4f49a01e02e8c47d84480f6fb92700aa091133c894821fff83c7502c7af136d9
dce2d575bef073079c658edfa872a15546b422ad2b74267d33b386dc7cc85b47

Reference C2s:

https://46[.]17[.]97[.]12/website/
https://174[.]37[.]6[.]34/98157cdfe45945293201e71acb2394d2
https://75[.]126[.]60[.]251/store/

Also Read

Dangerous Android Malware that Steals Banking Credentials, Call Forwarding, Keylogging, and Ransomware Activities

Trickbot Malware Re-emerging via MS Word Documents with Powerful Code-Injection Technique

FBI Uncovered North Korean Malware Attack KEYMARBLE on U.S Government Entities to Stealing Sensitive Data

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Marks & Spencer Confirms Customer Data Breach in Recent Cyber Attack

British retail giant Marks & Spencer has officially confirmed that customer personal data was...

Zoom Workplace Apps Flaws Allow Hackers to Gain Elevated Access

Zoom has released multiple security bulletins addressing seven newly discovered vulnerabilities in Zoom Workplace...

PoC Exploit Published for macOS Sandbox Escape Vulnerability (CVE-2025-31258)

Security researchers have disclosed a new macOS sandbox escape vulnerability tracked as CVE-2025-31258, accompanied...

Four Hackers Caught Exploiting Old Routers as Proxy Servers

U.S. authorities unsealed charges against four foreign nationals accused of operating a global cybercrime...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Researchers Uncover Remote IT Job Fraud Scheme Involving North Korean Nationals

The United States indicted fourteen North Korean nationals for orchestrating a sophisticated scheme to...

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware...

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as...