ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

MITRE Techniques

• [T1059.001 ] PowerShell – The toolkit is delivered and executed through PowerShell scripts for staging, monitoring, updating, and command execution (‘it installs SCMBANKER, a PowerShell toolkit’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – Persistence is achieved through logon-triggered execution paths and repeated relaunch behavior (‘Registry Run key … runs hidden PowerShell launching run.vbs’).
• [T1547.001 ] Registry Run Keys / Startup Folder – Persistence is established with a Run key and Startup folder copies of run.vbs (‘HKCU…Run, value “run”‘).
• [T1112 ] Modify Registry – The malware imports a registry blob to configure Remote Utilities Host and alters uninstall-related registry entries (‘imports a registry blob into HKLMSOFTWAREUsorisRemote Utilities HostHostParameters’).
• [T1056.001 ] Keylogging – A keylogging path exists via key.ps1 and rotor.ps1, indicating keyboard capture capability (‘the presence of rotor.ps1 and key.ps1 shows an additional keylogging capability’).
• [T1115 ] Clipboard Data – The clipboard is used to insert malicious commands and to replace copied banking account data (‘copying the malicious command to the victim’s clipboard’ and ‘replace the destination account’).
• [T1056.001 ] Input Capture: Keylogging – The keylogger module polls keyboard input and exfiltrates host data (‘Telegram-backed keylogger’).
• [T1564.003 ] Hidden Window – Scripts are launched with hidden windows and hidden implant directories to reduce visibility (‘runs hidden PowerShell’ and ‘attrib +h +s’).
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – The toolkit checks elevation and manipulates the environment to delay or frustrate analysis (‘checks if it is running as admin via net session’).
• [T1057 ] Process Discovery – The banking monitor inspects visible window titles and processes to detect target activity (‘checks all visible window titles every second’).
• [T1204.001 ] User Execution: Malicious Link – Victims are socially engineered into running a command from a fake verification page (‘asks the visitor to complete an image challenge’).
• [T1105 ] Ingress Tool Transfer – Multiple components are downloaded from open directories and remote URLs (‘All malicious scripts, files, and binaries are pulled individually via bitsadmin’).
• [T1027 ] Obfuscated Files or Information – Win32 API names and scripts are Base64-encoded or otherwise obscured (‘Base64-encodes its Win32 API names’).
• [T1021.001 ] Remote Services: Remote Desktop Protocol – The operation installs a remote-access product to obtain interactive access (‘deploy a commercial remote-access tool’).
• [T1021.002 ] Remote Services: SMB/Windows Admin Shares – Files are staged into public directories and reused across startup/persistence paths, consistent with local admin-style deployment (‘downloads the installer to C:UsersPublic’).
• [T1055 ] Process Injection – Not explicitly stated as injection, but the toolkit uses process-mutation rotators and launcher wrappers to continually respawn payloads (‘short-lived wrappers’).