Friday, April 19, 2024

Dark Tequila Malware Steals Financial Information and Login Details of Popular Websites

Security researchers from Kaspersky uncovered a malware campaign that is active for almost Five years since from 2013. The malware campaign dubbed Dark Tequila primarily targets Mexican users.

Dark Tequila was designed to steal the financial credentials of customers associated with Mexican banking institutions and also the login credentials of the popular websites ranging from code versioning repositories to public file storage accounts and domain registrars.

Dark Tequila Malware Delivery

The malware will be delivered only if certain conditions are met. It is a multi-stage payload it checks for the system to see any security software installed or the sample is being run in an analysis environment.

Attackers use to deliver the malware through online spear-phishing and the offline infection through USB device. The threat actors behind Dark Tequila carefully monitor’s it’s activities, if any user installs the malware outside of Mexico then the attackers uninstall the malware remotely.

According to researchers “The malicious implant contains all the modules required for the operation and, when instructed to do so by the command server, different modules decrypt and activate. All stolen data is uploaded to the server in encrypted form.”

Dark Tequila Modules

Module 1: Command and Control Server

It takes care of the communication between the command and control server and also it verifies that any man-in-the-middle network check is being performed to defend against analysis.

Module 2 – CleanUp

If it detects any security program or suspicious activity or likes running on a virtual machine it executes the cleanup module and performs a full cleanup of the system.

Module 3 – Advanced Keylogger

Designed to steal credentials from a list of online banking and generic sites such as Cpanel, Plesk, online flight reservation systems, Microsoft Office365, IBM Lotus Notes clients, Zimbra email, Bitbucket, Amazon, GoDaddy, Register, Namecheap, Dropbox, Softlayer, Rackspace, and other services.

Module 4 – Password Stealer

It steals the password from Email’s, FTP clients and as well as from the browsers.

Module 5 – USB Infector

It makes the malware to move offline through the victim’s network, it copies itself if the USB inserted on the affected system and get ready to spread for another machine.

Module 6 – watchdog

Monitoring service to make sure the malware is running properly.

The campaign is still active and it can be deployed to any part of the word and it can attack any targets.

Reference hashes:


Reference C2s:


Also Read

Dangerous Android Malware that Steals Banking Credentials, Call Forwarding, Keylogging, and Ransomware Activities

Trickbot Malware Re-emerging via MS Word Documents with Powerful Code-Injection Technique

FBI Uncovered North Korean Malware Attack KEYMARBLE on U.S Government Entities to Stealing Sensitive Data


Latest articles

Alert! Windows LPE Zero-day Exploit Advertised on Hacker Forums

A new zero-day Local Privilege Escalation (LPE) exploit has been put up for sale...

Palo Alto ZeroDay Exploited in The Wild Following PoC Release

Palo Alto Networks has disclosed a critical vulnerability within its PAN-OS operating system, identified...

FIN7 Hackers Attacking IT Employees Of Automotive Industry

IT employees in the automotive industry are often targeted by hackers because they have...

Russian APT44 – The Most Notorious Cyber Sabotage Group Globally

As Russia's invasion of Ukraine enters its third year, the formidable Sandworm (aka FROZENBARENTS,...

SoumniBot Exploiting Android Manifest Flaws to Evade Detection

A new banker, SoumniBot, has recently been identified. It targets Korean users and is...

LeSlipFrancais Data Breach: Customers’ Personal Information Exposed

LeSlipFrancais, the renowned French underwear brand, has confirmed a data breach impacting its customer...

Cisco Hypershield: AI-Powered Hyper-Distributed Security for Data Center

Cisco has unveiled its latest innovation, Cisco Hypershield, marking a milestone in cybersecurity.This groundbreaking...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles