{
  "family": "mekotio",
  "sample_count": 44,
  "category": "trojan",
  "description": "Trojan:Win32/Mekotio is a massive, highly sophisticated banking trojan primarily targeting financial institutions in Latin America (LATAM), though it has expanded globally. Written largely in Delphi, Mekotio is infamous for its complex, multi-stage infection chains, its use of massive SQL databases to track victims, and its ability to simulate fraudulent banking pop-ups to steal credentials and One-Time Passwords (OTPs).<br><br><b>Understanding Mekotio</b><br>To the victim, Mekotio infection begins with a convincing, localized phishing email (often mimicking regional tax authorities or utility companies). When they eventually access their bank, they are presented with a flawless, interactive overlay that intercepts their login. For threat intelligence analysts, Mekotio represents a highly organized cybercriminal enterprise. The malware is heavily modular; the initial infection simply profiles the machine and connects to a backend C2 infrastructure built on robust SQL databases to determine if the victim is a valuable target before deploying the massive, main banking payload.<br><br><b>Execution and Evasion Strategies</b><br>The attack chain is notoriously complex (`T1204.002`). A phishing email contains a link to a ZIP file, which contains an MSI installer or a VBScript. This script reaches out to a legitimate, compromised web server (often WordPress sites) to download a secondary ZIP. This ZIP contains three files: a legitimate executable (like `AutoHotkey.exe`), a malicious DLL, and an encrypted payload. Mekotio uses DLL Side-Loading (`T1574.002`) to execute the malicious DLL via the legitimate application. The malware actively monitors browser windows; when a targeted bank URL is detected, it utilizes a fake, transparent overlay (often created with Delphi forms) to steal the credentials (`T1185`). It also features a backdoor component, allowing the attackers to manually take control of the victim's mouse and keyboard to execute fraudulent transactions during an active session.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe financial fraud. EDR platforms will detect the complex execution chain: script host (`wscript.exe`) downloading a ZIP, followed by a legitimate application side-loading an unsigned DLL. Network logs will reveal Mekotio communicating with its C2, often using customized HTTP protocols or pulling configuration data directly from public SQL databases. The presence of large Delphi-compiled executables and encrypted `.dat` files in the `AppData` folder is a strong IoC.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1204.002",
    "T1056.001",
    "T1574.002",
    "T1185"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1574.002",
      "name": "Hijack Execution Flow: DLL Side-Loading",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint to sever the attacker's interactive backdoor access and halt the exfiltration of banking credentials.",
    "Capture a forensic memory image to extract the decrypted Mekotio payload, the C2 SQL database connection strings, and the list of targeted banking URLs.",
    "Do NOT trust any web session initiated from the infected machine; the malware actively utilizes overlays to simulate legitimate banking portals.",
    "Assume total compromise of all financial accounts accessed from the machine; initiate mandatory password resets and contact the relevant institutions."
  ],
  "what_to_avoid": [
    "Do not rely solely on blocking initial phishing URLs; Mekotio's multi-stage infrastructure utilizes dozens of compromised, legitimate websites.",
    "Avoid assuming standard AV removal tools are sufficient; the DLL side-loading persistence mechanism often requires a clean OS rebuild."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}