Banco del Pacífico Phishing Kit bl54hwhz

IOK Rule (edit)

title: Banco del Pacífico Phishing Kit bl54hwhz
description: |
    Detects a different Banco del Pacífico phishing kit deployed often on replit.com.
    
references:
    - https://urlscan.io/result/28c040ae-192d-483d-9447-f9a45fd652d7
    - https://www.intermatico.com/ebanking/seguridad/login.htm

detection:

    title:
      html|contains:
        - <title>Banco del Pacífico</title>

    favicon:
      html|contains:
        - href="img/pacificon.ico"

    form:
      html|contains|all:
        - form id="login" name="login" method="post"
        - action="load.php"

    img:
      html|contains|all:
        - img src="img/logo_pacifico1.png"
        - img src="img/alert-octagon.png"
        - img src="img/key.png"
        - img src="img/globe.png"

    condition: title and favicon and form and img

tags:
  - kit
  - target.banco_del_pacifico
  - target_country.ecuador