ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

Date: 07/09/2026

Severity: High

Summary

Human-Driven Fraud: The Mexican banking operation REF6045 relies on active human operators to monitor infected devices. Malicious Entry Point: Victims are compromised via fake CAPTCHA pages that trick them into executing a harmful command. PowerShell Backbone: The initial command installs SCMBANKER, a PowerShell toolkit using components from late 2025. Session Interception: Operators receive live alerts the moment a victim opens a targeted online banking session. Deceptive Tactics: Attackers can lock screens with fake warnings, redirect browsers, or modify clipboard account numbers. Full Compromise :For total device takeover, the operators deploy standard commercial remote-access tools.

Indicators of Compromise (IOC) List

Domains/URLs

ratonvaquero2026.online

monteviral2026.duckdns.org

osogransd.online

negratomasa2026.online

gestionmontelavaria2026.online

ssinvestigaciones.com

bancaporinternetbbmx.online

IP Address

68.211.161.46

216.250.112.100

185.242.246.169

Hash

b30cb0aa977aacdab94d2ef503186c8f0b2fc10d7cf0d7c7c0ada70c127dc7e8

554f1aefeb698995501751328c2f9fe93f02a680679fba3dd15f1ed93d46bf1b

ff3555154e91e42490cc722b6c7f3c4c91654b7ef53a35d0719ffb89accf1b27

526287a40aad1b218228cdd1f459ad3b93f858585048347644d597c6ab19515a

685d29ce8a550feb3a9e1d1c5926ec5e927615cf34aab62c108a812a1eb6737c

8c87ea94401fa97d3743a87604e088d1a29c7b06cf9673623941a42da68452a6

6dcd7fdd5e088d98d861cbd1cb74a7b83ae5508f4dbb617413bcbe7fbc8a82e2

4d9c160ebb44507b11f0e6421f691900284f25b5530a23d9fd50de0ae01663ca

0315d4a7bc14654ad66d4c2b98920b92ca18cbc231b3ce5fba1fcac70b828e19

5d17645548a44fe39d3cc816ffa3933321c1eb8b08a8f4348e3cd82f25112c81

566f4bfdfea54129b8528d50cae187a9030e2f2787749add4b0db22ac35ea581

882d582e85d5bb7abbdde791a2d52e3b1bb7dd7f79c20318ce64b74249221fdb

eea08fbf3720d638af1d313d3ce369708b77d7891379d5c5871dd7f36667ed0c

70140aa236d630a7d5ed08be3dafcccea9a8b0eec6dadf8c1cf1b96d8f608609

6c8ba7127a83431432e85946976c18bb3f3e9bf9def68aae572cd1d9d73604c7

81a4512db985359ed361755da58a1177b07632b5aee951c68a6ace54f4d0534b

3d9015429d65276869ceb9c91f10d6474b1098042db75949c49b9f1682c1f3ae

5bc85b604eb37ffa1e67c57f4744b55ef876a1ab442e2a2440550ef0922aeec7

30ff24faad80184bb43660a8bd317df99a8d09d31bae3b446aaa876543f2620f

4b7b35b921d7615b7a82a42c379560d1b0c5a74c81311a269874195ba2744f2d

32d981b3e7c36aa7030cfd9ee412bff742e00b36c39c80634b2681f89de4a487

cd7b179dd98848a02b9a1d4ebfeee26cdbb317b4ad53eb50786e18515b0cf804

345e8a90b7b762b065333cd068811d88086d157be713d89bdf200c927645f3d8

0ec9b518f84b6bdc0e843b89fa755522ec67db862414ad16bdcaa8c2be25485c

26f906a2a4276b1968a8ce956a7b342aa9bc26f60d32c14668223877f569fb3f

13bfd0f695cea1d6ae570a7ca056ffe930467be73a26f29f95209618f383bd2d

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Detection Query 1 :	domainname like "ratonvaquero2026.online" or url like "ratonvaquero2026.online" or siteurl like "ratonvaquero2026.online" or domainname like "bancaporinternetbbmx.online" or url like "bancaporinternetbbmx.online" or siteurl like "bancaporinternetbbmx.online" or domainname like "negratomasa2026.online" or url like "negratomasa2026.online" or siteurl like "negratomasa2026.online" or domainname like "gestionmontelavaria2026.online" or url like "gestionmontelavaria2026.online" or siteurl like "gestionmontelavaria2026.online" or domainname like "monteviral2026.duckdns.org" or url like "monteviral2026.duckdns.org" or siteurl like "monteviral2026.duckdns.org" or domainname like "ssinvestigaciones.com" or url like "ssinvestigaciones.com" or siteurl like "ssinvestigaciones.com" or domainname like "osogransd.online" or url like "osogransd.online" or siteurl like "osogransd.online"
Detection Query 2 :	dstipaddress IN ("185.242.246.169","68.211.161.46","216.250.112.100") or srcipaddress IN ("185.242.246.169","68.211.161.46","216.250.112.100")
Detection Query 3 :	sha256hash IN ("30ff24faad80184bb43660a8bd317df99a8d09d31bae3b446aaa876543f2620f","4b7b35b921d7615b7a82a42c379560d1b0c5a74c81311a269874195ba2744f2d","882d582e85d5bb7abbdde791a2d52e3b1bb7dd7f79c20318ce64b74249221fdb","eea08fbf3720d638af1d313d3ce369708b77d7891379d5c5871dd7f36667ed0c","6c8ba7127a83431432e85946976c18bb3f3e9bf9def68aae572cd1d9d73604c7","70140aa236d630a7d5ed08be3dafcccea9a8b0eec6dadf8c1cf1b96d8f608609","554f1aefeb698995501751328c2f9fe93f02a680679fba3dd15f1ed93d46bf1b","b30cb0aa977aacdab94d2ef503186c8f0b2fc10d7cf0d7c7c0ada70c127dc7e8","0ec9b518f84b6bdc0e843b89fa755522ec67db862414ad16bdcaa8c2be25485c","5d17645548a44fe39d3cc816ffa3933321c1eb8b08a8f4348e3cd82f25112c81","685d29ce8a550feb3a9e1d1c5926ec5e927615cf34aab62c108a812a1eb6737c","526287a40aad1b218228cdd1f459ad3b93f858585048347644d597c6ab19515a","4d9c160ebb44507b11f0e6421f691900284f25b5530a23d9fd50de0ae01663ca","0315d4a7bc14654ad66d4c2b98920b92ca18cbc231b3ce5fba1fcac70b828e19","13bfd0f695cea1d6ae570a7ca056ffe930467be73a26f29f95209618f383bd2d","3d9015429d65276869ceb9c91f10d6474b1098042db75949c49b9f1682c1f3ae","345e8a90b7b762b065333cd068811d88086d157be713d89bdf200c927645f3d8","81a4512db985359ed361755da58a1177b07632b5aee951c68a6ace54f4d0534b","ff3555154e91e42490cc722b6c7f3c4c91654b7ef53a35d0719ffb89accf1b27","8c87ea94401fa97d3743a87604e088d1a29c7b06cf9673623941a42da68452a6","32d981b3e7c36aa7030cfd9ee412bff742e00b36c39c80634b2681f89de4a487","cd7b179dd98848a02b9a1d4ebfeee26cdbb317b4ad53eb50786e18515b0cf804","5bc85b604eb37ffa1e67c57f4744b55ef876a1ab442e2a2440550ef0922aeec7","6dcd7fdd5e088d98d861cbd1cb74a7b83ae5508f4dbb617413bcbe7fbc8a82e2","566f4bfdfea54129b8528d50cae187a9030e2f2787749add4b0db22ac35ea581","26f906a2a4276b1968a8ce956a7b342aa9bc26f60d32c14668223877f569fb3f")

Reference:

https://www.elastic.co/security-labs/mexican-banking-fraud-scmbanker-ref6045

ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

Summary

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Tags

Comments

ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

Summary

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Tags

Share This

Comments