Mekotio Banking Trojan Resurfaces with New Attacking and Stealth Techniques

guest · Nov 3, 2021

Mekotio Banking Trojan Resurfaces with New Attacking and Stealth Techniques
November 3, 2021
https://thehackernews.com/2021/11/mekotio-banking-trojan-resurfaces-with.html

The operators behind the Mekotio banking trojan have resurfaced with a shift in its infection flow so as to stay under the radar and evade security software, while staging nearly 100 attacks over the last three months.

"One of the main characteristics […] is the modular attack which gives the attackers the ability to change only a small part of the whole in order to avoid detection," researchers from Check Point Research said in a report shared with The Hacker News. The latest wave of attacks are said to primarily target victims located in Brazil, Chile, Mexico, Peru, and Spain.
Click to expand...

The evolved version of the Mekotio malware strain is designed for compromising Windows systems with an attack chain that commences with phishing emails masquerading as pending tax receipts and containing a link to a ZIP file or a ZIP file as an attachment. Clicking open the ZIP archive triggers the execution of a batch script that, in turn, runs a PowerShell script to download a second-stage ZIP file.

The malicious modules are characterized by the use of simple obfuscation techniques, such as substitution ciphers, giving the malware improved stealth capabilities and enabling it to go undetected by most antivirus solutions.

"There's a very real danger in the Mekotio banker stealing usernames and passwords, in order to gain entry into financial institutions," Check Point's Kobi Eisenkraft said. "Hence, the arrests stopped the activity of the Spanish gangs, but not the main cybercrime groups behind Mekotio."
Click to expand...

Check Point Research: Mekotio Banker Returns with Improved Stealth and Ancient Encryption

A banking Trojan called “Mekotio” that targeted Latin America countries in the past, now making a comeback with a change in its infection flow.

Check Point Research (CPR) detected over 100 attacks in recent weeks using the Trojan’s new technique

The infection starts out and distributed with a phishing email containing a link to a zip archive or a zip file as an attachment.

One of the main characteristics of those bankers, such as Mekotio, is the modular attack which gives the attackers the ability to change only a small part of the whole in order to avoid detection.

Click to expand...

Log in or Sign up

Mekotio Banking Trojan Resurfaces with New Attacking and Stealth Techniques

guest Guest

Log in or Sign up

Mekotio Banking Trojan Resurfaces with New Attacking and Stealth Techniques

guest Guest

Useful Searches