Rewterz Threat Alert – Mekotio Banking Trojan aka Melcoz – Active IOCs

Severity

Medium

Analysis Summary

Mekotio is a banking trojan that targets users in Latin America and Europe. It is primarily distributed via phishing emails and infected software installers. Once installed on a victim’s device, Mekotio can perform a variety of malicious actions, such as stealing login credentials for online banking accounts, keylogging, and taking screenshots. The malware is also capable of evading detection by antivirus software and can also use a variety of methods to maintain persistence on an infected system.

Mekotio is also known for its modular structure, which allows attackers to add new functionality to the malware as needed. The malware is typically sold on underground forums and is offered as a service, with the attackers charging a fee for the use of the malware and providing technical support to customers.

Additionally, Mekotio is a polymorphic malware, meaning that it can change its code structure each time it is executed, making it harder to detect by antivirus software. To protect against Mekotio and other banking trojans, it is important to use strong, unique passwords for all online accounts, avoid clicking on links in unsolicited emails, and keep all software up to date.

Impact

• Information Theft 
• Financial Loss 
• Exposure to Sensitive Information

Indicators of Compromise

MD5

• c1025816a3d75196c48a17387f8b47ef
• dd3e1b1b67b0e306ea439eea25dabde1
• 11e8a3a74862321699bf43ddd92e1de0

SHA-256

• 1336315ea7204e103af425ee84a162700bfe6efc48dbc823e8b04f0e246cb288
• bb4ab64877fd2cdde25846a3f8fbf32574dc4cd3b0b4fb293fca97956312d100
• 6b53d076be384b06241ab68cace76f1177bb6d50903afa464fd5cb24b21e74e7

SHA-1

• a1275bbd9a076a9cf91a67019ecaa1162c7f6650
• 02d0024ffc66fab38c6822b841e6050c795f0d1f
• ace27f2fb7955a9f9408166a908d0a0856ed130e

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Ensure that general security policies are employed including: implementing strong passwords, correct configurations, and proper administration security policies.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Patch and upgrade any platforms and software timely and make it into a standard security policy.