Rewterz Threat Alert – Mekotio Banking Trojan aka Melcoz – Active IOCs

Severity

Medium

Analysis Summary

Mekotio is a banking trojan that targets users in Latin America and Europe. It is primarily distributed via phishing emails and infected software installers. Once installed on a victim’s device, Mekotio can perform a variety of malicious actions, such as stealing login credentials for online banking accounts, keylogging, and taking screenshots. The malware is also capable of evading detection by antivirus software and can also use a variety of methods to maintain persistence on an infected system.

Mekotio is also known for its modular structure, which allows attackers to add new functionality to the malware as needed. The malware is typically sold on underground forums and is offered as a service, with the attackers charging a fee for the use of the malware and providing technical support to customers.

Additionally, Mekotio is a polymorphic malware, meaning that it can change its code structure each time it is executed, making it harder to detect by antivirus software. To protect against Mekotio and other banking trojans, it is important to use strong, unique passwords for all online accounts, avoid clicking on links in unsolicited emails, and keep all software up to date.

Impact

• Information Theft 
• Financial Loss 
• Exposure to Sensitive Information

Indicators of Compromise

MD5

• 705298ff98e0751cd8fa1fa450eccba7
• bf536adaffa4aab7e0f2aaf7e95fee3f
• 39f48b5e48196aa7f8631bc9e2a93234
• 817989747af68e2b91e5a3daf915bb91

SHA-256

• 5a483777d50aa99475eaf2fc2035ea6d7d31166217016d46dbed2f1b7e3708a9
• 21d4fe071bba01c33a97b4c5b0bb5e995ea7b41c4281c1affc4b8b8b2857f498
• 342da16b402410d4f4101a593d2796c9eef1c20e6af5b9f1cd558117ab93c6b9
• 5e93bd882bd30f78211051a1bfa8179519adced2aeb7fb6c95a01e288ebfec7a

SHA-1

• 7b77ef58690e48d1ae6cd03c38c8fd3da880307f
• a5afd77819a9e52fd600c408f649b50f4f73ea17
• b6b7e54ae3bab96a4c05fec30342bcbba50462bb
• 61d61c4bab3d249505b0a4c0a10066c53d058f29

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Ensure that general security policies are employed including: implementing strong passwords, correct configurations, and proper administration security policies.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Patch and upgrade any platforms and software timely and make it into a standard security policy.