Mekotio banking trojan imitates update alerts to steal Bitcoin

guest · Aug 13, 2020

Mekotio banking trojan imitates update alerts to steal Bitcoin
August 13, 2020
https://www.bleepingcomputer.com/ne...ojan-imitates-update-alerts-to-steal-bitcoin/

A versatile banking trojan targeting users in Latin America has been circulating in multiple countries including Mexico, Brazil, Chile, Spain, Peru, and Portugal.

The malware ensures persistence on infected systems and has advanced capabilities such as planting backdoors, stealing bitcoins, and exfiltrating credentials.
False site update popups
One behavior specific to Mekotio is uising system popups that impersonate system updates.

"Mekotio has several typical backdoor capabilities. It can take screenshots, manipulate windows, simulate mouse and keyboard actions, restart the machine, restrict access to various banking websites and update itself," explains a report released by ESET this week.
Click to expand...

C&C Server has cryptic SQL DB references
The command-and-control (C&C) servers used by Mekotio are either based on the open-source Delphi Remote Access PC project or uses an SQL database storing C&C commands.
A mysterious algorithm then runs arithmetic operations to dynamically generate the real C&C domain addresses.

ESET's researchers suspect there are multiple variants of Mekotio being developed concurrently. They have described this malware's development lifecycle "rather chaotic," much like other Latin American banking trojans.
Click to expand...

ESET: Mekotio: These aren’t the security updates you’re looking for…

Another in our occasional series demystifying Latin American banking trojans
In this installment of our series, we introduce Mekotio, a Latin American banking trojan targeting mainly Brazil, Chile, Mexico, Spain, Peru and Portugal. The most notable feature of the newest variants of this malware family is using a SQL database as a C&C server.
Click to expand...

Log in or Sign up

Mekotio banking trojan imitates update alerts to steal Bitcoin

guest Guest

Log in or Sign up

Mekotio banking trojan imitates update alerts to steal Bitcoin

guest Guest

Useful Searches