Rewterz Threat Alert – Mekotio Banking Trojan aka Melcoz – Active IOCs

Severity

Medium

Analysis Summary

Mekotio is a banking trojan that targets users in Latin America and Europe. It is primarily distributed via phishing emails and infected software installers. Once installed on a victim’s device, Mekotio can perform a variety of malicious actions, such as stealing login credentials for online banking accounts, keylogging, and taking screenshots. The malware is also capable of evading detection by antivirus software and can also use a variety of methods to maintain persistence on an infected system.

Mekotio is also known for its modular structure, which allows attackers to add new functionality to the malware as needed. The malware is typically sold on underground forums and is offered as a service, with the attackers charging a fee for the use of the malware and providing technical support to customers.

Additionally, Mekotio is a polymorphic malware, meaning that it can change its code structure each time it is executed, making it harder to detect by antivirus software. To protect against Mekotio and other banking trojans, it is important to use strong, unique passwords for all online accounts, avoid clicking on links in unsolicited emails, and keep all software up to date.

Impact

• Information Theft
• Financial Loss
• Exposure to Sensitive Information

Indicators of Compromise

MD5

• ab4df9c4ba85a7a1a89A4eae647e9c674
• 879e5c18b579e05b94aae922f14958a2

SHA-256

• c4da13c88b28a19f692821703265c4c30831b5d598c326bfd1e33932fa5bd78a
• 846ed7a9f078499c172433d619e0cabd0220ad1732a13b7fbf557ddcf533b427

SHA-1

• dfe2d4a7867da5e64fdbaeee490db31fd0eccd8d
• 304444c5eb3d4180fd9983f0d5ab568e5608003c

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Ensure that general security policies are employed including: implementing strong passwords, correct configurations, and proper administration security policies.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Patch and upgrade any platforms and software timely and make it into a standard security policy.