Do you know what Dark Tequila is?
Dark Tequila has managed to stay out of sight for 5 years now, and even though malware experts have unveiled this infection, it continues to be a real threat. Ever since the infection was first released in 2013, it was targeted at those living in Mexico. According to our research, the infection could delete itself if the IP address of the infected system does not place it in Mexico. Unfortunately, it is possible that the infection could be used to attack anyone anywhere, which is why it must not be overlooked by all Windows users, even those outside of Mexico. In this report, we explain the attack and activity of the malicious infection, and we show how to eliminate it. The issue is that most victims realize that they need to remove Dark Tequila after it attacks and successfully steals sensitive information. This is why it is most important to secure the operating system against this malware, and we show how to do that as well.
The malicious Dark Tequila is also known as Worm.Crastic, and that is because it has features of a worm. Our research team, however, classifies it as a keylogger because the primary goal behind this infection is to record sensitive information. First and foremost, we must discuss the distribution of this infection. While spam emails are used to spread the threat, just like many others – including some of the latest ransomware infections, Matrix-NEWRAR Ransomware and Wise Ransomware – USB drives can be employed too. If Dark Tequila is hidden in a removable drive, it can silently infect as soon as the drive is connected to a computer. Of course, if the computer is safeguarded by reliable anti-malware software, the infection does not stand a chance. In fact, our research team indicates that the infection deletes itself if it detects so-called malware analysis tools. If the infection is executed successfully, it might be able to replicate itself and spread across the network.
Dark Tequila is known as banking malware, and that is because it was created with the purpose of recording banking information. According to researchers, the infection attempts to record login data from Mexican banking sites and various mail accounts. The keylogger logs keystrokes whenever the victim is logging into banking websites, and that allows it to steal credentials. Dark Tequila also can obtain passwords that are saved on browsers and email clients. If the creator of the keylogger obtains login information, they can easily access your banking accounts and perform illicit transactions and even clean out accounts altogether. Needless to say, this is not an infection you can ignore. On the contrary, you have to remove the infection as soon as possible.
It is possible that you need to delete Dark Tequila even if security software is installed and is protecting your operating system because the infection can employ UPX and Yoda Crypter to conceal itself. Also, your security software might be outdated. If that is the case, other malicious threats might have attacked your operating system already! It might be time for an upgrade. If you have detected Dark Tequila, immediately scan your operating system to check if you need to delete other malicious infections too. We advice using up-to-date and reliable anti-malware software to remove Dark Tequila and reinstate full-time protection, but if you want to, you can also try to eliminate the keylogger manually.
Remove Dark Tequila
- Launch Windows Explorer by tapping keys Win+E.
- Enter %WINDIR% at the top to access the directory.
- Right-click and Delete a file named csrss.dll.
- Empty Recycle Bin to eliminate the threat completely.
N.B. Check all removable drives to make sure that malicious Dark Tequila was not installed. If it was, it could infect every computer the drivers are connected to. You can determine that the threat was installed if you find autorun.exe, autorun.inf, and pictures.exe files. If you find them, Delete them.
In non-techie terms:
Your online banking accounts can be hijacked if the malicious Dark Tequila invades your operating system because this infection can steal saved passwords, as well as record keystrokes to record login data when you log into banking websites. At the moment, the infection is targeted at users of Mexican banks, but it could cross over, which is why everyone needs to secure their operating systems against this malicious threat. It is most important to install trustworthy anti-malware software to keep security in check, but users need to be cautious about the spam emails they open and the USB drives they use too because they could contain the launcher of the infection. If you need to delete Dark Tequila from your system, utilize a reliable anti-malware tool, and it will take care of the infection automatically. Otherwise, follow the manual removal instructions you can see above.