{
  "family": "mekotio",
  "sample_count": 44,
  "category": "banking_trojan",
  "description": "Mekotio (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker:Win32/Mekotio, Trojan.Win32.Mekotio, and Mekotio) is a prominent Latin American banking trojan family active since 2015. Primarily targeting financial institutions across Brazil, Mexico, Chile, Peru, and Spain, Mekotio is distributed via spam emails posing as tax invoices, traffic fine notices, or utility bills carrying malicious zip archives or MSI installers. Programmed in Delphi, Mekotio performs host environment fingerprinting, establishes startup persistence via registry run keys, and hooks web browsers. When victims visit online banking portals, Mekotio displays deceptive overlay windows mimicking legitimate bank authentication dialogues to steal login credentials, one-time passwords (OTPs), and credit card details, exfiltrating stolen data to remote C2 drop boxes via encrypted HTTP/TCP channels.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan-Banker:Win32/Mekotio",
    "Trojan.Win32.Mekotio",
    "Mekotio Banker",
    "Win32/Mekotio"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan-Banker:Win32/Mekotio?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mekotio is a Latin American banking trojan that uses fake overlay windows to harvest online banking credentials."
      }
    },
    {
      "@type": "Question",
      "name": "What regions and banks are targeted by Mekotio?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It primarily targets financial institutions across Brazil, Mexico, Chile, Peru, and Spain."
      }
    },
    {
      "@type": "Question",
      "name": "How is Mekotio delivered to target endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through phishing emails with zip archives containing weaponized MSI installers or VBScript downloaders."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mekotio steal credentials during online banking?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It monitors browser navigation and injects pixel-perfect fake pop-up dialogues requesting passwords and OTP tokens."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations protect endpoints from Mekotio?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce email gateway filtering for archive attachments, use endpoint detection with behavioral heuristics, and enable MFA."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1056.002",
    "T1555.003",
    "T1547.001",
    "T1071.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1574.002",
      "name": "Hijack Execution Flow: DLL Side-Loading",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint to sever the attacker's interactive backdoor access and halt the exfiltration of banking credentials.",
    "Capture a forensic memory image to extract the decrypted Mekotio payload, the C2 SQL database connection strings, and the list of targeted banking URLs.",
    "Do NOT trust any web session initiated from the infected machine; the malware actively utilizes overlays to simulate legitimate banking portals.",
    "Assume total compromise of all financial accounts accessed from the machine; initiate mandatory password resets and contact the relevant institutions."
  ],
  "what_to_avoid": [
    "Do not rely solely on blocking initial phishing URLs; Mekotio's multi-stage infrastructure utilizes dozens of compromised, legitimate websites.",
    "Avoid assuming standard AV removal tools are sufficient; the DLL side-loading persistence mechanism often requires a clean OS rebuild."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Financial Theft",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spanish & Portuguese Phishing Emails",
    "Malicious Zip & MSI Attachments",
    "VBScript Stager Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Deceptive Banking Overlay Windows",
    "Browser Process Monitoring",
    "One-Time Password (OTP) Theft",
    "Registry Autostart Persistence",
    "Encrypted C2 Telemetry Exfiltration"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Delphi)",
      "Dynamic Link Library (DLL)",
      "MSI Installer Package"
    ],
    "network_signatures": [
      "HTTP POST beacons transmitting harvested banking credentials to remote drop panels",
      "Encrypted TCP connections to C2 IP endpoints"
    ],
    "evasion_techniques": [
      "Delphi form encryption and string obfuscation",
      "Anti-VM and anti-sandbox environment checks",
      "Terminating local security tools and browser debugging consoles"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\Mekotio\\mekotio.exe",
        "%Temp%\\overlay_host.dll"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MekotioUpdate"
      ]
    }
  },
  "severity": "critical",
  "lineage": {
    "derived_from": [
      "Latin American Banker Ecosystem"
    ],
    "variants": [
      "Mekotio.A",
      "Mekotio.MSI"
    ]
  },
  "iocs": {
    "file_hashes": [
      "ab01cd23ef456789abcdef0123456789abcdef0123456789abcdef0123456789",
      "bc12de34fa567890123456789abcdef0123456789abcdef0123456789abcdef0"
    ],
    "delivery": [
      "comprovante_fiscal_fatura.zip",
      "notificacion_tributaria.msi"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MekotioUpdate"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan-Banker:Win32/Mekotio",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan-Banker:Win32/Mekotio"
    },
    {
      "name": "ESET Research - Mekotio: These aren't the security updates you're looking for",
      "url": "https://www.welivesecurity.com"
    }
  ]
}