Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
58 IOCs
ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit
Threat Actors
Excerpt
A Mexican banking fraud operation we're tracking as REF6045 doesn't run on autopilot. A human operator is behind the wheel, monitoring infected machines and deciding what happens next. Victims are infected through fake CAPTCHA pages that trick them into running a single command, which installs SCMBANKER, a PowerShell toolkit with components dating back to at least October 2025. Once installed, the operator can see when a victim opens a banking session, lock the screen behind…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →58 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://216.250.112.100/validation.txt | High | Score 58/100 | First seen |
| URL | https://osogransd.online/ | High | Score 58/100 | First seen |
| URL | https://negratomasa2026.online/b/editor.php | High | Score 58/100 | First seen |
| URL | https://gestionmontelavaria2026.online/dashboard2/recData.php | High | Score 58/100 | First seen |
| SHA256 | 6dcd7fdd5e088d98d861cbd1cb74a7b83ae5508f4dbb617413bcbe7fbc8a82e2 | Medium | Score 53/100 | First seen |
| SHA256 | 5c7ab9e90b05804d07e9d803f85462bc1a44d0726256bad28219984ee2b5772f | Medium | Score 53/100 | First seen |
| SHA256 | b30cb0aa977aacdab94d2ef503186c8f0b2fc10d7cf0d7c7c0ada70c127dc7e8 | Medium | Score 53/100 | First seen |
| URL | http://68.211.161.46/validation.txt | High | Score 58/100 | First seen |
| SHA256 | 0315d4a7bc14654ad66d4c2b98920b92ca18cbc231b3ce5fba1fcac70b828e19 | Medium | Score 53/100 | First seen |
| URL | https://185.242.246.169/b/editor.php | High | Score 58/100 | First seen |
| URL | https://negratomasa2026.online/b/urlsscams.txt | High | Score 58/100 | First seen |
| SHA256 | 32d981b3e7c36aa7030cfd9ee412bff742e00b36c39c80634b2681f89de4a487 | Medium | Score 53/100 | First seen |
| URL | https://negratomasa2026.online/dashboard2/recData.php | High | Score 58/100 | First seen |
| URL | https://monteviral2026.duckdns.org/ | High | Score 58/100 | First seen |
| SHA256 | 345e8a90b7b762b065333cd068811d88086d157be713d89bdf200c927645f3d8 | Medium | Score 53/100 | First seen |
| SHA256 | 70140aa236d630a7d5ed08be3dafcccea9a8b0eec6dadf8c1cf1b96d8f608609 | Medium | Score 53/100 | First seen |
| URL | https://negratomasa2026.online/b/tarjetas.txt | High | Score 58/100 | First seen |
| SHA256 | ff3555154e91e42490cc722b6c7f3c4c91654b7ef53a35d0719ffb89accf1b27 | Medium | Score 53/100 | First seen |
| URL | https://negratomasa2026.online/b/keysnegativas.txt | High | Score 58/100 | First seen |
| SHA256 | 526287a40aad1b218228cdd1f459ad3b93f858585048347644d597c6ab19515a | Medium | Score 53/100 | First seen |
| URL | http://68.211.161.46/driver.html?off | High | Score 58/100 | First seen |
| SHA256 | 3d9015429d65276869ceb9c91f10d6474b1098042db75949c49b9f1682c1f3ae | Medium | Score 53/100 | First seen |
| SHA256 | 8c87ea94401fa97d3743a87604e088d1a29c7b06cf9673623941a42da68452a6 | Medium | Score 53/100 | First seen |
| SHA256 | 554f1aefeb698995501751328c2f9fe93f02a680679fba3dd15f1ed93d46bf1b | Medium | Score 53/100 | First seen |
| SHA256 | 5d17645548a44fe39d3cc816ffa3933321c1eb8b08a8f4348e3cd82f25112c81 | Medium | Score 53/100 | First seen |
| SHA256 | 4d9c160ebb44507b11f0e6421f691900284f25b5530a23d9fd50de0ae01663ca | Medium | Score 53/100 | First seen |
| URL | https://negratomasa2026.online/dashboard2/avisos2.php | High | Score 58/100 | First seen |
| URL | https://ratonvaquero2026.online/files/ | High | Score 58/100 | First seen |
| SHA256 | 6c8ba7127a83431432e85946976c18bb3f3e9bf9def68aae572cd1d9d73604c7 | Medium | Score 53/100 | First seen |
| SHA256 | 0ec9b518f84b6bdc0e843b89fa755522ec67db862414ad16bdcaa8c2be25485c | Medium | Score 53/100 | First seen |
| URL | https://bancaporinternetbbmx.online | High | Score 58/100 | First seen |
| URL | https://negratomasa2026.online/b/clabes.txt | High | Score 58/100 | First seen |
| SHA256 | 13bfd0f695cea1d6ae570a7ca056ffe930467be73a26f29f95209618f383bd2d | Medium | Score 53/100 | First seen |
| SHA256 | 5bc85b604eb37ffa1e67c57f4744b55ef876a1ab442e2a2440550ef0922aeec7 | Medium | Score 53/100 | First seen |
| SHA256 | 81a4512db985359ed361755da58a1177b07632b5aee951c68a6ace54f4d0534b | Medium | Score 53/100 | First seen |
| URL | https://gestionmontelavaria2026.online/b/editor.php | High | Score 58/100 | First seen |
| Domain | ssinvestigaciones.com | High | Score 58/100 | First seen |
| URL | https://fakeupdate.net/win10ue | High | Score 58/100 | First seen |
| URL | https://negratomasa2026.online/b/ | High | Score 58/100 | First seen |
| SHA256 | 26f906a2a4276b1968a8ce956a7b342aa9bc26f60d32c14668223877f569fb3f | Medium | Score 53/100 | First seen |
| URL | https://negratomasa2026.online/dashboard2/imagenes.php | High | Score 58/100 | First seen |
| SHA256 | 882d582e85d5bb7abbdde791a2d52e3b1bb7dd7f79c20318ce64b74249221fdb | Medium | Score 53/100 | First seen |
| URL | http://185.242.246.169/dashboard2/recData.php | High | Score 58/100 | First seen |
| SHA256 | 685d29ce8a550feb3a9e1d1c5926ec5e927615cf34aab62c108a812a1eb6737c | Medium | Score 53/100 | First seen |
| SHA256 | 566f4bfdfea54129b8528d50cae187a9030e2f2787749add4b0db22ac35ea581 | Medium | Score 53/100 | First seen |
| SHA256 | cd7b179dd98848a02b9a1d4ebfeee26cdbb317b4ad53eb50786e18515b0cf804 | Medium | Score 53/100 | First seen |
| URL | http://68.211.161.46/files/ | High | Score 58/100 | First seen |
| URL | https://negratomasa2026.online/b/listadebancos.txt | High | Score 58/100 | First seen |
| URL | https://ratonvaquero2026.online/ | High | Score 58/100 | First seen |
| URL | https://negratomasa2026.online/a/telekeylogger.txt | High | Score 58/100 | First seen |
| SHA256 | 30ff24faad80184bb43660a8bd317df99a8d09d31bae3b446aaa876543f2620f | Medium | Score 53/100 | First seen |
| URL | https://negratomasa2026.online/dashboard2/logs.php | High | Score 58/100 | First seen |
| URL | https://osogransd.online/files/ | High | Score 58/100 | First seen |
| URL | https://negratomasa2026.online/a/teleavisos.txt | High | Score 58/100 | First seen |
| URL | https://monteviral2026.duckdns.org/files/ | High | Score 58/100 | First seen |
| SHA256 | eea08fbf3720d638af1d313d3ce369708b77d7891379d5c5871dd7f36667ed0c | Medium | Score 53/100 | First seen |
| SHA256 | 4b7b35b921d7615b7a82a42c379560d1b0c5a74c81311a269874195ba2744f2d | Medium | Score 53/100 | First seen |
| URL | http://68.211.161.46/ | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…