Mekotio Banking Trojan Resurfaces with New Attacking and Stealth Techniques

The operators driving the Mekotio banking trojan have resurfaced with a change in its infection flow so as to continue to be less than the radar and evade security software program, although staging virtually 100 assaults above the last three months.

“One of the primary attributes […] is the modular attack which gives the attackers the skill to adjust only a modest component of the total in order to stay away from detection,” scientists from Test Place Exploration mentioned in a report shared with The Hacker Information. The most current wave of assaults are stated to mainly target victims found in Brazil, Chile, Mexico, Peru, and Spain.

The enhancement will come soon after Spanish regulation enforcement businesses in July 2021 arrested 16 folks belonging to a legal network in link with working Mekotio and yet another banking malware termed Grandoreiro as portion of a social engineering marketing campaign concentrating on fiscal institutions in Europe.

The developed edition of the Mekotio malware pressure is designed for compromising Windows units with an attack chain that commences with phishing e-mails masquerading as pending tax receipts and containing a link to a ZIP file or a ZIP file as an attachment. Clicking open the ZIP archive triggers the execution of a batch script that, in switch, operates a PowerShell script to download a second-stage ZIP file.

This secondary ZIP file residences a few diverse files — an AutoHotkey (AHK) interpreter, an AHK script, and the Mekotio DLL payload. The aforementioned PowerShell script then calls the AHK interpreter to execute the AHK script, which operates the DLL payload to steal passwords from online banking portals and exfiltrate the outcomes back again to a distant server.

The malicious modules are characterized by the use of easy obfuscation approaches, this sort of as substitution ciphers, providing the malware enhanced stealth abilities and enabling it to go undetected by most antivirus remedies.

“There’s a quite genuine hazard in the Mekotio banker thieving usernames and passwords, in get to achieve entry into economic establishments,” Look at Point’s Kobi Eisenkraft stated. “That’s why, the arrests stopped the action of the Spanish gangs, but not the major cybercrime teams at the rear of Mekotio.”

Users in Latin The us are extremely proposed to use two-aspect authentication to secure their accounts from takeover attacks, and view out for lookalike domains, spelling errors in emails or internet sites, and email messages from unfamiliar senders.

Found this report exciting? Abide by THN on Facebook, Twitter  and LinkedIn to read through a lot more exclusive written content we article.

Some parts of this article are sourced from:
thehackernews.com