Metel

Overview

Trojan:Win32/Metel (also known as Corkow) is a highly sophisticated, multi-stage Banking Trojan and APT-style framework that achieved massive notoriety in 2015 for executing targeted attacks directly against banking infrastructure. Unlike traditional banking trojans that target the bank's customers (e.g., via web injects), Metel targets the bank's internal network to gain control of domain controllers and internal payment processing systems, ultimately enabling massive, automated ATM cash-outs (`T1486`).

Understanding Metel (Bank Backend Compromise)
To an infected endpoint within a bank, Metel initially operates like a stealthy backdoor. For a financial security operations center (SOC), a Metel infection is a catastrophic event indicating a 'bank heist' in progress. The attackers use the initial infection to map the network, escalate privileges, and specifically target administrators who manage card processing or ATM networks.

Execution and Jackpotting Mechanics
Metel is typically introduced via spear-phishing (`T1566.001`) targeting bank employees. The initial payload is heavily obfuscated and establishes deep persistence. Once inside, the operators manually drive the infection, moving laterally (`T1021`) to locate the servers controlling ATM networks. The most notorious capability of Metel is manipulating the backend transaction processing: when money is withdrawn from an ATM using a specific card, Metel intercepts the transaction confirmation on the bank's internal network and forces the system to automatically 'rollback' the transaction balance. This allows the physical 'money mules' at the ATM to withdraw infinite cash while the account balance remains unchanged.

Indicators of Compromise & Impact
The impact is multi-million dollar financial theft directly from the bank's reserves. Host-based IoCs are complex due to the bespoke nature of the attacks but often involve the presence of custom Mimikatz (`T1003.001`) modules for credential theft, and modified administrative tools (like PsExec) used for lateral movement. Network IoCs include anomalous internal traffic routing toward payment processing VLANs and unexpected administrative logins to critical financial servers from standard workstations.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1003.001: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_METEL {
    meta:
        description = "Detects Metel (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "metel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Metel Activity
id: d2c47dcb1546ef21c2ddcca3e4dd80e4
status: experimental
description: Detects generic indicators of the metel malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*metel*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately sever the affected internal network segments from the core payment processing and ATM management VLANs.
2. Initiate a massive credential reset for all Domain Administrators and highly privileged service accounts associated with payment processing.
3. Hunt for custom memory-resident backdoors and unauthorized usage of administrative tools (PsExec, WMI) across the domain.
4. Engage specialized Incident Response and coordinate with law enforcement and financial regulatory bodies immediately.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the attack is isolated to a single endpoint; Metel operators always seek Domain Admin privileges.
2. Avoid restoring critical financial servers from backups without ensuring the backups are not also compromised by the persistent backdoor.

References & External Analysis

• Search "metel" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Smshoax
• Luhn
• Remote
• Kura
• Hotkeyshook

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/metel.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.