Trusted Design

New Infostealer Trojan uses Fiddler Proxy

概要

Zscaler ThreatLabZ came across a new Infostealer Trojan written in .NET that utilizes popular tools like Fiddler & Json.NET for its operation. In April, the new Infostealer family of Spanish origin was first noted targeting users in the U.S. and Mexico. The malware authors are currently targeting users of Mexico's second largest bank, Banamex, but it is capable of updating the configuration file to include more financial institutions.

Created: 2026-02-23

Indicators

• FileHash-MD5 - ac6027d316070dc6d2fd3b273162f2ee -
• URL - http://saysa.com.co/js/curp.pdf.exe -
• FileHash-MD5 - 06f3da0adf8a18679d51c6adaa100bd4 -
• URL - http://cigm.co/js/slick/curp.pdf.exe -
• FileHash-MD5 - 8c9896440fb0c8f2d36aff0382c9c2e4 -
• URL - http://denticenter.com.co/js/slick/curp.pdf.exe -
• FileHash-MD5 - 98bbc1917613c4a73b1fe35e3ba9a8d9 -
• FileHash-MD5 - 123f4c1d2d3d691c2427aca42289fe85 -
• FileHash-MD5 - 070ab6aa63e658ff8a56ea05426a71b4 -
• URL - http://saysa.com.co/js/rfc.pdf.exe -
• URL - http://bestdentalimplants.co.in/js/curp.pdf.exe -

類似Pulses

• Zscaler's Spymel - signed malware (score: 0.68)
• Infostealer.Banprox.B (score: 0.64)
• ZSCALER 2015-12-13: New Spy Banker Trojan Telax (score: 0.60)
• Hybrid Trojan Goznym Emerges (score: 0.60)
• New Spy Banker Trojan Telax abusing Google Cloud Servers (score: 0.60)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る