Torisma

Malware Profile Updated 3 months ago
Download STIX
Preview STIX
Torisma is a sophisticated malware implant discovered during an in-depth analysis of suspicious cyber activities. The malware, along with another implant called Doris, are base64 encoded and embedded within ASP server-side scripts. These scripts contain code to create a binary stream where the Torisma implant resides. Upon decoding the base64 blob, an AES encrypted payload is revealed, indicating a highly secure method of delivering the malicious software. The Torisma implant is custom developed for specialized monitoring, executing custom shellcode based on specific victim profiles. The operation of Torisma involves a complex system of checks and actions. If a victim's IP address is on the allow-list and their operating system architecture bit value is "1" (indicating a 64-bit system), a 64-bit version of the Torisma implant is sent to the victim. This event is logged as "case_1_64", signifying the delivery of the 64-bit version of the implant. Furthermore, the malware includes the URL for the Command and Control (C2) server and decryption keys for a second stage payload named "Torisma". Our analysis also reveals a previously unknown second stage implant known as Torisma, which executes custom actions depending on the victim's profile. A significant discovery is the backend code for the Torisma implant, located in an ASP page named view.asp. This page, encoded using VB.Encode, contains numerous functions designed to handle requests from the implant and interact with the infected victim. This insight into Torisma and its capabilities provides further understanding of Operation North Star and the second-stage implant.
What's your take? (Question 1 of 4)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Doris
1
"Doris" is a potent malware, working in tandem with another implant known as "Torisma". Both of these malicious programs are base64 encoded, allowing them to infiltrate systems and cause significant damage. Once installed, they can steal personal information, disrupt operations, or even hold data ho
Case_1_64
1
None
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Operation No...
Implant
Payload
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the Torisma Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
MITRE
a year ago
Operation North Star: Behind The Scenes | McAfee Blog