Mekotio

Overview

Trojan:Win32/Mekotio is a massive, highly sophisticated banking trojan primarily targeting financial institutions in Latin America (LATAM), though it has expanded globally. Written largely in Delphi, Mekotio is infamous for its complex, multi-stage infection chains, its use of massive SQL databases to track victims, and its ability to simulate fraudulent banking pop-ups to steal credentials and One-Time Passwords (OTPs).

Understanding Mekotio
To the victim, Mekotio infection begins with a convincing, localized phishing email (often mimicking regional tax authorities or utility companies). When they eventually access their bank, they are presented with a flawless, interactive overlay that intercepts their login. For threat intelligence analysts, Mekotio represents a highly organized cybercriminal enterprise. The malware is heavily modular; the initial infection simply profiles the machine and connects to a backend C2 infrastructure built on robust SQL databases to determine if the victim is a valuable target before deploying the massive, main banking payload.

Execution and Evasion Strategies
The attack chain is notoriously complex (`T1204.002`). A phishing email contains a link to a ZIP file, which contains an MSI installer or a VBScript. This script reaches out to a legitimate, compromised web server (often WordPress sites) to download a secondary ZIP. This ZIP contains three files: a legitimate executable (like `AutoHotkey.exe`), a malicious DLL, and an encrypted payload. Mekotio uses DLL Side-Loading (`T1574.002`) to execute the malicious DLL via the legitimate application. The malware actively monitors browser windows; when a targeted bank URL is detected, it utilizes a fake, transparent overlay (often created with Delphi forms) to steal the credentials (`T1185`). It also features a backdoor component, allowing the attackers to manually take control of the victim's mouse and keyboard to execute fraudulent transactions during an active session.

Indicators of Compromise & Impact
The impact is severe financial fraud. EDR platforms will detect the complex execution chain: script host (`wscript.exe`) downloading a ZIP, followed by a legitimate application side-loading an unsigned DLL. Network logs will reveal Mekotio communicating with its C2, often using customized HTTP protocols or pulling configuration data directly from public SQL databases. The presence of large Delphi-compiled executables and encrypted `.dat` files in the `AppData` folder is a strong IoC.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.
• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_MEKOTIO {
    meta:
        description = "Detects Mekotio (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "mekotio" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Mekotio Activity
id: 442f0d416e7d1192a568740dbf5e53b3
status: experimental
description: Detects generic indicators of the mekotio malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*mekotio*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint to sever the attacker's interactive backdoor access and halt the exfiltration of banking credentials.
2. Capture a forensic memory image to extract the decrypted Mekotio payload, the C2 SQL database connection strings, and the list of targeted banking URLs.
3. Do NOT trust any web session initiated from the infected machine; the malware actively utilizes overlays to simulate legitimate banking portals.
4. Assume total compromise of all financial accounts accessed from the machine; initiate mandatory password resets and contact the relevant institutions.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely solely on blocking initial phishing URLs; Mekotio's multi-stage infrastructure utilizes dozens of compromised, legitimate websites.
2. Avoid assuming standard AV removal tools are sufficient; the DLL side-loading persistence mechanism often requires a clean OS rebuild.

References & External Analysis

• Search "mekotio" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Popad
• Vitro
• Iezones
• Enfal
• Hyperbro

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/mekotio.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.