Tourmaline.exe is a multi-stage malware delivered through a social engineering technique involving a fake Cloudflare "Verify you are human" popup. The installer is a custom Inno Setup 6.7.0 (Revision 2) binary that extracts a Python 3.11 runtime and two obfuscated Python payload stages. Stage 1 implements a time-lock anti-sandbox mechanism by brute forcing an XOR key via a countdown loop, which can be bypassed in O(1) using a known-plaintext attack. Stage 2 is a Python backdoor that reads the machine GUID, derives a mutex, and retrieves the active C2 IP address from an Ethereum Sepolia smart contract. The malware uses a custom DNS tunnel over UDP port 53 to communicate with the C2, disguising traffic as microsoft.com DNS queries. Commands are ChaCha20-encrypted and ECDSA-signed to prevent interception or sinkholing. The backdoor supports arbitrary Python code execution, file operations, shell commands, and self-updates. Persistence is maintained via Task Scheduler under a misleading service name. The repository includes deobfuscated source, YARA rules, IOCs, and a decryption tool.

The malware enables full remote code execution on infected Windows hosts, allowing attackers to execute arbitrary Python code, upload/download files, run shell commands, and maintain persistent access. Its use of blockchain-based C2 IP resolution and DNS tunneling complicates detection and mitigation, rendering traditional IP blocklisting ineffective. The anti-sandbox time-lock delays analysis and detection in virtualized environments. This backdoor can be used for espionage, data theft, lateral movement, or further payload deployment.

No official patch or vendor advisory is available for this malware. Mitigation relies on user awareness to avoid executing commands from suspicious popups or websites. Network defenders should deploy YARA rules and IOCs from the public repository to detect and block the malware. Monitoring for suspicious DNS traffic to unusual IPs on port 53, especially queries resembling microsoft.com but directed to uncommon IPs, can help identify infections. Traditional IP blocklisting is ineffective due to blockchain-based dynamic C2 resolution. Sandboxing solutions should consider the anti-sandbox time-lock mechanism. Incident responders should remove persistence entries named "TourmalineUpdate" or "Hardware monitoring service" in Task Scheduler and clean related files. Use the provided decryption tools and indicators for forensic analysis.