Banco Cuscatlan Phishing Kit sDtLTM

Detects a phishing kit targeting Banco Cuscatlan, a bank and financial institution operating in Central America. Found as a result of this kit being deployed on Replit.

References

IOK Rule (edit) 

title: Banco Cuscatlan Phishing Kit sDtLTM
description: |
    Detects a phishing kit targeting Banco Cuscatlan, a bank and financial institution operating in Central America.
    Found as a result of this kit being deployed on Replit.


references:
    - https://www.bancocuscatlan.com/
    - https://urlscan.io/result/75fa3a29-7305-4215-bac2-159718725693/
    - https://urlscan.io/result/671232a5-e570-4e15-a0a4-e93e7d75d500/

detection:

    images:
      html|contains|all:
        - src="img/log.png"
        - src="img/arr.png"
        - src="img/olv.png"
        - src="img/titulo.png"

    form:
      html|contains:
        - form action="php/inde.php" class="form" method="post"


    condition: images and form

tags:
  - kit
  - target.banco_cuscatlan