Torisma

Torisma is a sophisticated malware implant discovered during an in-depth analysis of suspicious cyber activities. The malware, along with another implant called Doris, are base64 encoded and embedded within ASP server-side scripts. These scripts contain code to create a binary stream where the Torisma implant resides. Upon decoding the base64 blob, an AES encrypted payload is revealed, indicating a highly secure method of delivering the malicious software. The Torisma implant is custom developed for specialized monitoring, executing custom shellcode based on specific victim profiles. The operation of Torisma involves a complex system of checks and actions. If a victim's IP address is on the allow-list and their operating system architecture bit value is "1" (indicating a 64-bit system), a 64-bit version of the Torisma implant is sent to the victim. This event is logged as "case_1_64", signifying the delivery of the 64-bit version of the implant. Furthermore, the malware includes the URL for the Command and Control (C2) server and decryption keys for a second stage payload named "Torisma". Our analysis also reveals a previously unknown second stage implant known as Torisma, which executes custom actions depending on the victim's profile. A significant discovery is the backend code for the Torisma implant, located in an ASP page named view.asp. This page, encoded using VB.Encode, contains numerous functions designed to handle requests from the implant and interact with the infected victim. This insight into Torisma and its capabilities provides further understanding of Operation North Star and the second-stage implant.