Компания Talos обнаружила фишинговую спам-кампанию, направленную на потенциальных жертв в Мексике и заманивающую пользователей загрузить новый обфусцированный похититель информации, который Talos называет TimbreStealer и который активен по крайней мере с ноября 2023 года. Он содержит несколько встроенных модулей, используемых для оркестровки, расшифровки и защиты бинарных файлов вредоносного ПО.
Злоумышленник распространял TimbreStealer через спам-кампанию, используя мексиканскую тематику, связанную с налогами, начиная как минимум с ноября 2023 года. Злоумышленник ранее использовал аналогичные тактики, техники и процедуры (TTP) для распространения банковского трояна, известного как "Mispadu".
Indicators of Compromise
IPv4
- 104.131.169.252
- 104.131.67.109
- 137.184.108.25
- 137.184.115.230
- 138.197.34.162
- 142.93.50.216
- 143.244.144.166
- 143.244.160.115
- 146.190.208.30
- 157.230.238.116
- 157.245.8.79
- 159.223.96.160
- 159.89.226.127
- 159.89.50.225
- 159.89.90.109
- 162.243.171.207
- 167.71.24.13
- 167.71.245.175
- 167.71.246.120
- 192.241.141.137
- 24.144.96.15
- 24.199.98.128
- 45.55.65.159
- 64.225.29.249
Domains
- 0.solucionegos.top
- auditoria38.meinastrohoroskop.com
- auditoria42.altavista100.com
- auditoria67.mariageorgina.com
- auditoria7.miramantolama.com
- auditoria82.taoshome4sale.com
- auditoria84.meinastrohoroskop.com
- auditoria88.mariageorgina.com
- auditoria89.venagard.com
- auditoria92.venagard.com
- auditoria93.serragrandreunion.com
- bailandolambada.com
- chidoriland.com
- comprobante14.miramantolama.com
- comprobante2.marcialledo.com
- comprobante27.mariageorgina.com
- comprobante27.serragrandreunion.com
- comprobante27.servicioslocomer.online
- comprobante45.altavista100.com
- comprobante51.meinastrohoroskop.com
- comprobante63.serragrandreunion.com
- comprobante68.portafoliocfdi.com
- comprobante70.miramantolama.com
- comprobante75.meinastrohoroskop.com
- comprobante80.serragrandreunion.com
- comprobante91.servicioslocomer.online
- comprobante93.venagard.com
- cumplimiento19.altavista100.com
- cumplimiento35.solucionegos.top
- cumplimiento39.meinastrohoroskop.com
- cumplimiento43.commerxion.buzz
- cumplimiento47.solucionegos.top
- cumplimiento48.callarlene.net
- cumplimiento56.timbradoelectronico.com
- cumplimiento72.serragrandreunion.com
- cumplimiento81.paulfenelon.com
- cumplimiento91.miramantolama.com
- cumplimiento94.meinastrohoroskop.com
- cumplimiento98.serragrandreunion.com
- factura10.miramantolama.com
- factura20.facturascorporativas.com
- factura20.solunline.top
- factura34.changjiangys.net
- factura4.servicioslocomer.online
- factura40.miramantolama.com
- factura44.servicioslocales.online
- factura46.facturasfiel.com
- factura49.marcialledo.com
- factura50.callarlene.net
- factura59.altavista100.com
- factura7.taoshome4sale.com
- factura71.servicioslomex.online
- factura72.serragrandreunion.com
- factura73.mariageorgina.com
- factura81.altavista100.com
- factura90.changjiangys.net
- factura91.servicioslocomer.online
- folio24.serragrandreunion.com
- folio24.spacefordailyrituals.com
- folio47.marcialledo.com
- folio53.mariageorgina.com
- folio60.callarlene.net
- folio75.taoshome4sale.com
- folio75.venagard.com
- folio76.miramantolama.com
- folio83.altavista100.com
- folio89.changjiangys.net
- folio90.servicioslocomer.online
- folio99.solunline.top
- manderlyx.com
- pdf21.changjiangys.net
- pdf33.venagard.com
- pdf34.solucionpiens.top
- pdf39.facturasonlinemx.com
- pdf43.marcialledo.com
- pdf49.marcialledo.com
- pdf50.changjiangys.net
- pdf57.visual8298.top
- pdf59.venagard.com
- pdf63.paulfenelon.com
- pdf65.verificatutramite.com
- pdf70.mariageorgina.com
- pdf81.photographyride.com
- pdf85.miramantolama.com
- pdf93.venagard.com
- pdf98.solunline.top
- portal27.marcialledo.com
- portal34.solunline.top
- portal48.solucionpiens.top
- portal50.solucionegos.top
- portal55.solucionegos.top
- portal63.paulfenelon.com
- portal70.solunline.top
- portal80.changjiangys.net
- portal86.serragrandreunion.com
- portal90.meinastrohoroskop.com
- portal92.solucionpiens.top
- suscripcion0.venagard.com
- suscripcion10.solunline.xyz
- suscripcion24.facturasonlinemx.com
- suscripcion24.venagard.com
- suscripcion32.servicioslocomer.online
- suscripcion38.eagleservice.buzz
- suscripcion38.mariageorgina.com
- suscripcion57.changjiangys.net
- suscripcion65.g1ooseradas.buzz
- suscripcion84.taoshome4sale.com
- suscripcion95.servicioslomex.online
- timbrado0.meinastrohoroskop.com
- timbrado11.verificatutramite.com
- timbrado16.taoshome4sale.com
- timbrado17.marcialledo.com
- timbrado17.mariageorgina.com
- timbrado2.serviciosna.top
- timbrado2.solucionegos.top
- timbrado33.meinastrohoroskop.com
- timbrado42.mariageorgina.com
- timbrado54.changjiangys.net
- timbrado6.meinastrohoroskop.com
- timbrado73.mariageorgina.com
- timbrado74.callarlene.net
- timbrado74.mexicofacturacion.com
- timbrado80.paulfenelon.com
- timbrado84.miramantolama.com
- timbrado90.porcesososo.online
- timbrado96.paulfenelon.com
- trilivok.com
- validacion22.hb56.cc
URLs
- http://folio24.spacefordailyrituals.com/facdigital/55ae12184283dc
- http://folio47.marcialledo.com/seg_factura/e6bab6d032e282
- http://pdf43.marcialledo.com/factura/50e1e86db86ff2
- http://suscripcion95.servicioslomex.online/cfdi/0faa4a21fff2bb
- https://0.solucionegos.top/timbreDigital/e99522f778ea6a
- https://69.64.35.1/~route649289/
- https://auditoria38.meinastrohoroskop.com/factura/b5b0c16b999573
- https://auditoria42.altavista100.com/factura/b20569ae393e7e
- https://auditoria67.mariageorgina.com/cfdi/bb743b25f5c526
- https://auditoria7.miramantolama.com/factura/d84d576baf1513
- https://auditoria82.taoshome4sale.com/seg_factura/efebfc104991d4
- https://auditoria84.meinastrohoroskop.com/timbreDigital/8f7b2f8304d08e
- https://auditoria88.mariageorgina.com/factura/3db4832ada4f80
- https://auditoria89.venagard.com/timbreDigital/f6a5f34123d980
- https://auditoria92.venagard.com/factura/2c6652a143f815
- https://auditoria93.serragrandreunion.com/timbreDigital/a2e79b61ac4635
- https://bailandolambada.com/5iplivg7q/gn4md5c/it.php?f=2&w=Windows%2010
- https://chidoriland.com/1r49ucc73/hs4q07q/it.php?f=2&w=Windows%2010
- https://comprobante14.miramantolama.com/seg_factura/fb0b02b2d41b12
- https://comprobante2.marcialledo.com/factura/3ce069ac2b865e
- https://comprobante27.mariageorgina.com/timbreDigital/eada68119275aa
- https://comprobante27.serragrandreunion.com/facdigital/bca7513c9e00b9
- https://comprobante27.servicioslocomer.online/factura/2003b3fe7ae6f4
- https://comprobante45.altavista100.com/cfdi/d13011c95ba2b0
- https://comprobante51.meinastrohoroskop.com/facdigital/121c0388193ba5
- https://comprobante63.serragrandreunion.com/facdigital/3c45bca741d4f6
- https://comprobante68.portafoliocfdi.com/seg_factura/58c0146a753186
- https://comprobante70.miramantolama.com/timbreDigital/18665ae0a7b9e1
- https://comprobante75.meinastrohoroskop.com/timbreDigital/bfa30824f1120b
- https://comprobante80.serragrandreunion.com/timbreDigital/bf4a8735ed3953
- https://comprobante91.servicioslocomer.online/timbreDigital/adb6403b186182
- https://comprobante93.venagard.com/cfdi/57880f98ef2b70
- https://cumplimiento19.altavista100.com/timbreDigital/dd141e683a3056
- https://cumplimiento35.solucionegos.top/factura/bde64155cabbe5
- https://cumplimiento39.meinastrohoroskop.com/seg_factura/d4e9d7823adff2
- https://cumplimiento43.commerxion.buzz/facdigital/1ac5acb1a5525b
- https://cumplimiento47.solucionegos.top/seg_factura/7fa6018dc9b68f
- https://cumplimiento48.callarlene.net/seg_factura/c19a0dd4addc3e
- https://cumplimiento56.timbradoelectronico.com/facdigital/dd37434dcde7ad
- https://cumplimiento72.serragrandreunion.com/seg_factura/92cd2425a6c150
- https://cumplimiento81.paulfenelon.com/cfdi/20149ee8e1d3b2
- https://cumplimiento91.miramantolama.com/seg_factura/e907d32bf0d056
- https://cumplimiento94.meinastrohoroskop.com/cfdi/bd56529f9d1411
- https://cumplimiento98.serragrandreunion.com/factura/3f209bc16cbb9a
- https://factura10.miramantolama.com/factura/039d9cbaeec9b5
- https://factura20.facturascorporativas.com/seg_factura/9622cf8c695873
- https://factura20.solunline.top/cfdi/6401eac16211b2
- https://factura34.changjiangys.net/facdigital/52490c838bd94f
- https://factura4.servicioslocomer.online/cfdi/f2369d09a54ad9
- https://factura40.miramantolama.com/cfdi/9318466130e6af
- https://factura44.servicioslocales.online/cfdi/25e8a6f5393e1f
- https://factura46.facturasfiel.com/factura/021bd5fa122bb2
- https://factura49.marcialledo.com/factura/fc2cc5bf671dd0
- https://factura50.callarlene.net/cfdi/867d138f26fb23
- https://factura59.altavista100.com/seg_factura/0179ae05a51830
- https://factura7.taoshome4sale.com/factura/eebf49f810a0a6
- https://factura71.servicioslomex.online/timbreDigital/5de7db415c7e8e
- https://factura72.serragrandreunion.com/seg_factura/728423dceff50c
- https://factura73.mariageorgina.com/cfdi/71deea8cdbcb10
- https://factura81.altavista100.com/factura/8421cd5cb1c8e4
- https://factura90.changjiangys.net/timbreDigital/029a6531330379
- https://factura91.servicioslocomer.online/timbreDigital/2952b54a9542f1
- https://folio24.serragrandreunion.com/seg_factura/548b685f48dd30
- https://folio24.spacefordailyrituals.com/facdigital/55ae12184283dc
- https://folio47.marcialledo.com/seg_factura/e6bab6d032e282
- https://folio53.mariageorgina.com/seg_factura/ca2fd939c046fa
- https://folio60.callarlene.net/seg_factura/367b377baf47e5
- https://folio75.taoshome4sale.com/cfdi/7482bf3f2690af
- https://folio75.venagard.com/cfdi/7718efe0fd3952
- https://folio76.miramantolama.com/cfdi/a74b25b75c7182
- https://folio83.altavista100.com/factura/20f00b7d569c85
- https://folio89.changjiangys.net/factura/b645784e80f71a
- https://folio90.servicioslocomer.online/facdigital/d1950dc8f24757
- https://folio99.solunline.top/facdigital/b7928d4e0eade5
- https://hamster69.senac2021.org/~armadillo492370/
- https://manderlyx.com/cruto/it.php?f=2&w=Windows%2010
- https://pdf21.changjiangys.net/cfdi/2f99e7adf61c47
- https://pdf33.venagard.com/timbreDigital/91849e7d9fe4ad
- https://pdf34.solucionpiens.top/seg_factura/2dfed5bc7fcbf6
- https://pdf39.facturasonlinemx.com/seg_factura/66971f3669145a
- https://pdf49.marcialledo.com/factura/729c18972d690c
- https://pdf50.changjiangys.net/factura/cdb5ed3876c4bf
- https://pdf57.visual8298.top/factura/5239e15a8324ab
- https://pdf59.venagard.com/cfdi/5791bf23c6929e
- https://pdf63.paulfenelon.com/timbreDigital/3ae250718da0ca
- https://pdf65.verificatutramite.com/facdigital/e1ec8098e50a0b
- https://pdf70.mariageorgina.com/cfdi/fab1264f158f44
- https://pdf81.photographyride.com/seg_factura/4eb3832fe6d1bd
- https://pdf85.miramantolama.com/factura/74f871b7ca1977
- https://pdf93.venagard.com/factura/f24a53f8932b3f
- https://pdf98.solunline.top/timbreDigital/f57e558c31a86e
- https://portal27.marcialledo.com/timbreDigital/f8a5f05b3c1651
- https://portal34.solunline.top/cfdi/a068bb0da7eea1
- https://portal48.solucionpiens.top/timbreDigital/15ec5fc2aaf26a
- https://portal50.solucionegos.top/factura/8d4c6f7e2a4c7f
- https://portal55.solucionegos.top/seg_factura/f5f59070b20629
- https://portal63.paulfenelon.com/seg_factura/77907fa76c7c59
- https://portal70.solunline.top/timbreDigital/92b380d91a67a0
- https://portal80.changjiangys.net/cfdi/2224782a3b7f1d
- https://portal86.serragrandreunion.com/facdigital/68da4282591283
- https://portal90.meinastrohoroskop.com/factura/64f247c6238c38
- https://portal92.solucionpiens.top/timbreDigital/34893de446d532
- https://snapdragon50.crimsondragonemperor.com/~aster963249/
- https://suscripcion0.venagard.com/timbreDigital/5c86c63ca1ffda
- https://suscripcion10.solunline.xyz/facdigital/ebe0cb51090e51
- https://suscripcion24.facturasonlinemx.com/factura/d6a6f8208ed508
- https://suscripcion24.venagard.com/timbreDigital/50c6f1fad17f5e
- https://suscripcion32.servicioslocomer.online/facdigital/22ccd8880c217e
- https://suscripcion38.eagleservice.buzz/cfdi/6dadfe1a18cffc
- https://suscripcion38.mariageorgina.com/factura/9c787623800b5e
- https://suscripcion57.changjiangys.net/factura/22ad73593f724a
- https://suscripcion65.g1ooseradas.buzz/factura/9f03d9ef3d73b5
- https://suscripcion84.taoshome4sale.com/cfdi/e4af3e6e22a8a6
- https://suscripcion95.servicioslomex.online/cfdi/0faa4a21fff2bb
- https://timbrado0.meinastrohoroskop.com/cfdi/515c9b9087c737
- https://timbrado11.verificatutramite.com/facdigital/f7640878ebc0f9
- https://timbrado16.taoshome4sale.com/timbreDigital/259029c9d7f330
- https://timbrado17.marcialledo.com/factura/2ea580ee99d5f1
- https://timbrado17.mariageorgina.com/seg_factura/95a6c2c0e004d8
- https://timbrado2.serviciosna.top/facdigital/c5cb33d68be323
- https://timbrado2.solucionegos.top/seg_factura/7c867709e85c67
- https://timbrado33.meinastrohoroskop.com/timbreDigital/aaf2cc575db42c
- https://timbrado42.mariageorgina.com/facdigital/f0f82ab0c87b32
- https://timbrado54.changjiangys.net/cfdi/04e4e38338d82a
- https://timbrado6.meinastrohoroskop.com/cfdi/5290b37e80850a
- https://timbrado73.mariageorgina.com/timbreDigital/ff862f9245e8b6
- https://timbrado74.callarlene.net/timbreDigital/eb52e334a2c0b3
- https://timbrado74.mexicofacturacion.com/factura/14fcb6e3eaf351
- https://timbrado80.paulfenelon.com/timbreDigital/684bc3f7d7e7f9
- https://timbrado84.miramantolama.com/cfdi/18864dcecc9e9c
- https://timbrado90.porcesososo.online/factura/cde31eb6fcac1d
- https://timbrado96.paulfenelon.com/facdigital/ef18828525a8fb
- https://trilivok.com/2ysz0gghg/cbt0mer/it.php?f=2&w=Windows%2010
- https://trilivok.com/3s9p2w9yy/bvhcc5x/it.php?f=9&w=Windows%2010
- https://validacion22.hb56.cc/seg_factura/8f845f6ba70820
SHA256
- 010b48762a033f91b32e315ebcefb8423d2b20019516fa8f2f3d54d57d221bdb
- 024f3c591d44499afb8f477865c557fc15164ab0f35594e0cfdfa76245459762
- 03cd17df83a7bdf459f16677560e69143d1788ce1fc7927200a09f82859d90ea
- 07521bd6acf725b8a33d1d91fd0cc7830d2cff66abdb24616c2076b63d3f36a8
- 075910c802f755d3178a8f1f14ee4cd7924fd4463c7491277bdf2681b16e593c
- 103d3e03ce4295737ef9b2b9dfef425d93238a09b1eb738ac0e05da0c6c50028
- 12bff33da7d9807252bb461d65828154b9b5b1dca505e8173893e3d410d40dd0
- 1aaa4fb29a88c83495de80893cd2476484af561bb29e8cdfc73ce38f6cd61a84
- 23b9e4103141d6a898773b1342269334e569bcf576cdcb4a905f24e26320cdab
- 27c1e41fde9bc0d5027a48ccada1af8c9c8f59937bf5f77edd21e49bd28f29a2
- 2a225784289f31adbaa8be0b8770495fa8950fce2b7352a0c7a566fc79067547
- 2a38b75e88f91f9cd28ef478e82c3b44f50e57cb958ba63e58f134d8bd368812
- 2a3f869e9e78b4d7945a60ceec27586c07bc8b0770be64463358fffe3b6b7395
- 2e04c36b7ddd6939b7bef258bfeba6f91a5c37a43389dd6d9a88eff5863df5ed
- 35b7dd775db142699228d3e64ee8e9a02c6d91bb49f7c2faf367df8ba2186fd6
- 43e99539e4b966dde2f9de8dc1ffb4a22bc560e54c01de9aef6b15fac1412714
- 46226d4fb7ffe15ba8167e3724f991c543731672e19ef40bb43fddc6df648d0a
- 46cc07a9287da26e238a74734d87e0aae984f4648a80a26547afa0de8c850afb
- 51be3a3b4ebd15c305c0f9b57388c449f88f0d6d2d46a0a838f046f0fd21b78f
- 55b0247b9b574978a4c9abd19c3bcc04ea78598398b9f8aeb35bd51cbd877576
- 56612bb0ab00cbb7af24326b027a55ff25852ddab1f1c8e24471b7ce97003505
- 5831f4f8ce715d4a021284e68af1b6d8040a2543484ac84b326eea20c543552e
- 58562e49c1612f08e56e7d7b3ca6cd78285948018b2998e45bd425b4c79ce1f4
- 5efa99b3cb17bec76fec2724bcfcc6423d0231bba9cf9c1aed63005e4c3c2875
- 600d085638335542de1c06a012ec9d4c56ffe0373a5f61667158fc63894dde9f
- 62495620b0d65d94bc3d68dec00ffbe607eacd20ab43dc4471170aa292cc9b1a
- 66af21ef63234c092441ec33351df0f829f08a2f48151557eb7a084c6275b791
- 682546addb38a938982f0f715b27b4ba5cda4621e63f872f19110d174851c4e9
- 69019b7b64deb5cc91a58b6a3c5e6b1b6d6665bd40be1381a70690ba2b305790
- 6bf082f001f914824a6b33f9bdd56d562c081097692221fb887035e80926d583
- 71ce48c89b22e99356c464c1541e2d7b9419a2c8fe8f6058914fc58703ba244f
- 7923d409959acffab49dda63c7c9c15e1bdd2b5c16f7fcfe8ef3e3108e08df87
- 795c0b82b37d339ea27014d73ad8f2d28c5066a7ceb6a2aa0d74188df9c311c9
- 7ac22989021082b9a377dcc582812693ce0733e973686b607e8fc2b52dcf181d
- 8420d77ba61925b03a1ad6c900a528ecacbb2c816b3e6bc62def40fc14e03b78
- 850dd47a0fb5e8b2b4358bf3aa1abd7ebaae577b6fc4b6b4e3d7533313c845b8
- 883674fa4c562f04685a2b733747e4070fe927e1db1443f9073f31dd0cb5e215
- 96363b2b9e4ed8044cb90b6619842ba8897b4392f9025cbfdccfda1ea7a14a58
- 97157c8bbeb8769770c4cb2201638d9ad0103ba2fdfed9bdbd03c53bd7a5fcb9
- a103b0c604ef32e7aabb16c2a7917fd123c41486d8e0a4f43dcf6c48d76de425
- a579bd30e9ee7984489af95cffb2e8e6877873fd881aa18d7f5a2177d76f7bf2
- a82fb82f3aa2f6123d2c0fb954ae558ac6e8862ef756b12136fbe8d533b30573
- a92934c014a7859bd122717f4c87f6bd31896cb87d28c9fac1a6af57ff8110f6
- aa187a53e55396238e97638032424d68ba2402259f2b308c9911777712b526af
- ab2a2465fccd7294580c11492c29a943c54415e0c606f41e08ce86d69e254ee4
- ababe815e11b762089180e5fb0b1eaffa6a035d630d7aaf1d8060bd5d9a87ea5
- b01e917dd14c780cb52cafcd14e4dd499c33822c7776d084d29cf5e0bb0bddb6
- b04a0a4a1520c905007a5d370ed2b6c7cb42253f4722cc55a9e475ae9ece1de7
- b1b85c821a7f3b5753becbbfa19d2e80e7dcbd5290d6d831fb07e91a21bdeaa7
- b3f4b207ee83b748f3ae83b90d1536f9c5321a84d9064dc9745683a93e5ec405
- b5a272acd842154b2069b60aab52568bbfde60e59717190c71e787e336598912
- ba7bc4cff098f49d39e16c224e001bd40a5d08048aeec531f771a54ee4a5ecef
- c29b9f79b0a34948bde1dfca3acecca6965795917c7d3444fcacba12f583fb98
- c99237a5777a2e8fa7da33460a5b477d155cc26bc2e297a8563516a708323ead
- ca652fc3a664a772dbf615abfe5df99d9c35f6a869043cf75736e6492fbd4bea
- ce135a7e0410314126cacb2a2dba3d6d4c17d6ee672c57c097816d64eb427735
- d3ff98b196717e66213ccf009cbeed32250da0e2c2748d44f4ee8fb4f704407c
- e04cee863791c26a275e0c06620ea7403c736f8cafbdda3417f854ae5d81a49f
- e65e25aee5947747f471407a6cce9137695e4fee820f990883b117726195988c
- e87325f4347f66b21b19cfb21c51fbf99ead6b63e1796fcb57cd2260bd720929
- e8ed09b016ea62058404c482edf988f14a87c790d5c9bd3d2e03885b818ef822
- febf9c5ede3964fdb3b53307a3d5ef7b0e222705a3bb39bef58e28aaba5eed28
- ff3769c95b8a5cdcba750fda5bbbb92ef79177e3de6dc1143186e893e68d45a4