Mekotio Banking Trojan Resurges with Tweaked Code, Stealthy Campaign

The Mekotio Latin American banking trojan is bouncing back again after several of the gang that operates it ended up arrested in Spain. A lot more than 100 attacks in new months have featured a new an infection plan, indicating that the team carries on to actively retool.

“The new marketing campaign started right right after the Spanish Civil Guard declared the arrest of 16 folks included with Mekotio [aka Metamorfo] distribution in July,” in accordance to Examine Position Investigate (CPR). “It appears that the gang driving the malware had been able to narrow the gap swiftly and modify practices to stay clear of detection.”

Mekotio, like other Latin American banking trojans, steals on the net banking logins and other economic credentials from unsuspecting victims. But they’re continuously evolving to prevent detection. In this circumstance, the freshened-up Mekotio infection vector contains “unprecedented elements” to maintain detection fees small, in accordance to the firm’s evaluation, issued Wednesday. These are:

• A stealthier batch file with at minimum two levels of obfuscation
• New fileless PowerShell script that runs instantly in memory and
• Use of Themida v3 for packing the closing DLL payload.

“In the very last 3 months, we observed somewhere around 100 attacks use new, very simple obfuscation procedures, with the help of a substitution cipher, to cover the very first module of the attack,” according to CPR. “This basic obfuscation system will allow it to go undetected by most of the antivirus goods.”

Layers and Levels in the Malware Deployment

The attacks are multistage in all phases, and they commence with Spanish-language phishing e-mails that contains a .ZIP archive backlink or .ZIP file attachment. The lure is a assert that the email includes a digital tax receipt pending submission.

If a consumer is duped into clicking on both sort of .ZIP file, the aforementioned stealthy batch file executes. In turn, it issues a PowerShell command to obtain and operate a PowerShell script in memory.

Batch File Stealth

The batch file has two layers of obfuscation and frequently incorporates a file identify that starts with “Contacto,” in accordance to CPR.

“The first layer of the obfuscation is a straightforward substitution cipher,” researchers stated. “Substitution ciphers encrypt plaintext by replacing every single symbol in the plaintext with the corresponding symbol from the lookup table.”

The 2nd layer of obfuscation is a approach that requires slices of the command code and saves them in diverse ecosystem variables. When these are concatenated, the PowerShell command emerges that downloads the PowerShell script.

The PowerShell Script

The PowerShell script is accountable for conducting pre-infection checks, i.e., determining if the target is situated in a desired geography in just Latin America (Brazil, Chile, Mexico, Spain or Peru), and verifying that it’s not operating in a digital equipment/sandbox ecosystem.

“The subsequent thing the script does is to create an vacant file, used as a footprint, whose identify is the present date,” in accordance to the business. “This lets it know if it previously ran in the system. If the file by now exists, the script stops the execution.”

Immediately after that, it establishes persistence (by introducing a new price to the pursuing registry important: “HKCUSoftwareMicrosoftWindowsCurrentVersionRun”) and then it downloads a secondary .ZIP archive to the ProgramData Directory.

That secondary .ZIP archive contains 3 data files, which are extracted, renamed and saved in a new directory on the contaminated procedure. The PowerShell script checks the dimension of the extracted data files to distinguish concerning the variety and the reason of the files.

The to start with file is an interpreter for AutoHotkey (AHK), which is an open up-resource scripting language for Windows that allows buyers generate shortcuts to documents. The malware added its use of AHK to the combine last March as but a different evasion tactic.

The PowerShell script works by using the interpreter to run a 2nd file, which is an AHK script and the AHK script then operates the third file, which is the Mekotio payload (in the type of a DLL packed with Themida v3).

Themida is a legit software program protector/encryptor that was initially established to preserve a cyberattacker from specifically inspecting or modifying the code of a compiled application.

When unpacked, “the DLL contains the main Mekotio banker performance for actions these types of as thieving accessibility credentials for digital banking portals and a password stealer,” according to CPR evaluation. “The stolen information is despatched to the command-and-control server.”

Whilst banking trojans targeting Latin America are prevalent, they are attention-grabbing to review because they have a tendency to be modular, indicating that attackers can make little tweaks in order to remain off the detection radar, scientists famous.

“CPR sees a large amount of aged malicious code applied for a very long time, and but the attacks deal with to continue to be beneath the radar of antivirus and endpoint detection and reaction (EDR) remedies by transforming packers or obfuscation methods this kind of as a substitution cipher,” they explained. “Our evaluation of this marketing campaign highlights the attempts that attackers make to conceal their destructive intentions, bypass security filtering and trick buyers.”

How to Shield In opposition to Banking Trojans

To safeguard versus this type of attack, CPR presented the adhering to essential anti-social-engineering guidelines:

Be suspicious of any email or conversation from a familiar manufacturer or corporation that asks you to click on on a connection or open an hooked up doc

Beware of lookalike domains, spelling errors in e-mails or web-sites, and unfamiliar email senders

Be careful with documents been given via email from mysterious senders, primarily if they prompt for a specified motion you would not normally do

Don’t click on on promotional one-way links in e-mail, and rather, Google the vendor and simply click the backlink from the Google outcomes web page

Beware of “special” offers that really do not seem to be reliable or trusted purchase possibilities and

Do not reuse passwords involving distinct apps and accounts.

Verify out our free upcoming stay and on-demand from customers on the web town halls – unique, dynamic conversations with cybersecurity gurus and the Threatpost neighborhood.