Threat Research · blog.talosintelligence.com

TimbreStealer Targets Mexican Users Through Tax-Themed Phishing

Feb 27, 2024 · Original article ↗

Summary

Talos describes a campaign active since at least November 2023 that uses tax- and invoice-themed phishing to deliver TimbreStealer to users in Mexico, detailing its obfuscation, anti-analysis, persistence and information-stealing capabilities.

Key points

Phishing emails impersonating Mexican tax receipts or invoices send victims to compromised sites that deliver a ZIP containing a deceptive internet shortcut; victims must open it to start the infection.
Geofencing limits delivery to users in Mexico, while visitors from other locations receive a blank PDF.
TimbreStealer uses layered encrypted modules, direct system calls, custom loaders and Heaven’s Gate, alongside sandbox and debugger checks.
The malware installs through scheduled tasks and registry-based execution, and can inject its payload into preferred svchost.exe processes.
Preliminary analysis indicates it can collect browser credentials and history, files, and system and hardware information; Talos had not confirmed communication with the suspected command-and-control servers.
Talos links the activity with high confidence to an earlier Mispadu distribution campaign based on shared tactics, though it found no hard evidence confirming the connection.
Talos published Snort and ClamAV detections and associated indicators of compromise.

Article Details

Attack Vectors: Tax receipt and invoice-themed phishing emails direct users in Mexico to malicious pages on compromised websites.
Distribution pages check geolocation and browser characteristics, delivering ZIP archives to users in Mexico and blank PDFs to visitors elsewhere.
Victims must open the downloaded ZIP archive and double-click a PDF-disguised .url shortcut, which retrieves the initial dropper through WebDAV over HTTP.
The installer registers a scheduled task that adds a RunOnce registry entry and invokes rundll32.exe through iernonce.dll; under certain conditions it also configures startup scripts through Group Policy.
The installed loader attempts to inject a 64-bit DLL into selected svchost.exe processes, with a 32-bit shellcode fallback if injection fails.
Defensive Notes: Applicable Snort SIDs are 63057–63072 and 300840–300844.
Published ClamAV detections include Win.Infostealer.TimbreStealer-10021027-0, Win.Infostealer.TimbreStealer-10021026-0, Win.Infostealer.Generic-10017202-0, Win.Packed.Generic-10019162-0, and Win.Dropper.Generic-10017203-0.
Analysis must account for geofencing, language and timezone checks, debugger and virtualization detection, and browser-use checks that can prevent payload execution.
The global decryption key changes throughout execution, so bypassing execution stages or anti-analysis checks can prevent subsequent modules from decrypting.
The loader patches ZwTraceEvent and replaces loaded DLL contents with clean disk copies to interfere with user-mode telemetry and security hooks.
Final-payload analysis was incomplete. Talos identified potential C2 URLs but did not observe analyzed samples communicating with them.
Although the malware calls functions that remove System Restore points, Talos reported no observed ransomware activity on infected victims.

Indicators of compromise

Type	Indicator	Context
SHA256	`600d085638335542de1c06a012ec9d4c56ffe0373a5f61667158fc63894dde9f`	JavaScript downloader artifact listed in the TimbreStealer research indicators.
SHA256	`883674fa4c562f04685a2b733747e4070fe927e1db1443f9073f31dd0cb5e215`	JavaScript artifact responsible for region checking and redirection in the delivery chain.
SHA256	`aa187a53e55396238e97638032424d68ba2402259f2b308c9911777712b526af`	Malicious shortcut artifact listed as FAC_560208_ATR890126GK2.url_.
SHA256	`b1b85c821a7f3b5753becbbfa19d2e80e7dcbd5290d6d831fb07e91a21bdeaa7`	CFDI_930209.zip distribution archive associated with the malicious shortcut delivery chain.
SHA256	`b3f4b207ee83b748f3ae83b90d1536f9c5321a84d9064dc9745683a93e5ec405`	Embedded Cecujujajofubo475.dll_ artifact associated with the installed TimbreStealer loader.
URL	`hxxp[:]//159[.]89[.]50[.]225/formato23/9577710738/1242144429.exe`	Externally hosted executable retrieved through the WebDAV shortcut chain in the Mispadu activity.
URL	`hxxps[:]//69[.]64[.]35[.]1/~route649289/`	Potential TimbreStealer C2 URL recovered during analysis; communication was not observed.
URL	`hxxps[:]//bailandolambada[.]com/5iplivg7q/gn4md5c/it.php?f=2&w=Windows%2010`	Mispadu HTTPS C2 URL observed in the preceding phishing activity.
URL	`hxxps[:]//chidoriland[.]com/1r49ucc73/hs4q07q/it.php?f=2&w=Windows%2010`	Mispadu HTTPS C2 URL observed in the preceding phishing activity.
URL	`hxxps[:]//hamster69[.]senac2021[.]org/~armadillo492370/`	Potential TimbreStealer C2 URL recovered from network-related functions; Talos did not observe communication to it.
URL	`hxxps[:]//manderlyx[.]com/cruto/it.php?f=2&w=Windows%2010`	Mispadu HTTPS C2 URL observed in the preceding phishing activity.
URL	`hxxps[:]//pdf85[.]miramantolama[.]com/factura/74f871b7ca1977`	Malicious distribution page on compromised infrastructure used in the TimbreStealer invoice-themed delivery chain.
URL	`hxxps[:]//snapdragon50[.]crimsondragonemperor[.]com/~aster963249/`	Potential TimbreStealer C2 URL listed by Talos; communication was not observed in analyzed samples.
URL	`hxxps[:]//suscripcion24[.]facturasonlinemx[.]com/factura/d6a6f8208ed508`	TimbreStealer distribution URL presented as part of the invoice-themed phishing activity.
URL	`hxxps[:]//suscripcion65[.]g1ooseradas[.]buzz/factura/9f03d9ef3d73b5`	TimbreStealer distribution URL used in the geofenced phishing delivery chain.
URL	`hxxps[:]//timbrado11[.]verificatutramite[.]com/facdigital/f7640878ebc0f9`	TimbreStealer distribution URL associated with the digital-invoice lure.
URL	`hxxps[:]//trilivok[.]com/2ysz0gghg/cbt0mer/it.php?f=2&w=Windows%2010`	Hardcoded HTTPS C2 URL used by Mispadu in the preceding distribution activity.