Metel

Overview

Trojan:Win32/Metel (also known as Corkow) is a highly sophisticated, multi-stage Banking Trojan and APT-style framework that achieved massive notoriety in 2015 for executing targeted attacks directly against banking infrastructure. Unlike traditional banking trojans that target the bank's customers (e.g., via web injects), Metel targets the bank's internal network to gain control of domain controllers and internal payment processing systems, ultimately enabling massive, automated ATM cash-outs (`T1486`).

Understanding Metel (Bank Backend Compromise)
To an infected endpoint within a bank, Metel initially operates like a stealthy backdoor. For a financial security operations center (SOC), a Metel infection is a catastrophic event indicating a 'bank heist' in progress. The attackers use the initial infection to map the network, escalate privileges, and specifically target administrators who manage card processing or ATM networks.

Execution and Jackpotting Mechanics
Metel is typically introduced via spear-phishing (`T1566.001`) targeting bank employees. The initial payload is heavily obfuscated and establishes deep persistence. Once inside, the operators manually drive the infection, moving laterally (`T1021`) to locate the servers controlling ATM networks. The most notorious capability of Metel is manipulating the backend transaction processing: when money is withdrawn from an ATM using a specific card, Metel intercepts the transaction confirmation on the bank's internal network and forces the system to automatically 'rollback' the transaction balance. This allows the physical 'money mules' at the ATM to withdraw infinite cash while the account balance remains unchanged.

Indicators of Compromise & Impact
The impact is multi-million dollar financial theft directly from the bank's reserves. Host-based IoCs are complex due to the bespoke nature of the attacks but often involve the presence of custom Mimikatz (`T1003.001`) modules for credential theft, and modified administrative tools (like PsExec) used for lateral movement. Network IoCs include anomalous internal traffic routing toward payment processing VLANs and unexpected administrative logins to critical financial servers from standard workstations.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1003.001: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_METEL_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Metel"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "metel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Metel (Trojan) Execution & Triage
id: d26d6140-eacb-54a4-a8e9-cdaa94c721c1
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Metel malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/metel
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1566_001
- attack.t1021
- attack.t1003_001
- attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_METEL_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Metel tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "metel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately sever the affected internal network segments from the core payment processing and ATM management VLANs.
2. Initiate a massive credential reset for all Domain Administrators and highly privileged service accounts associated with payment processing.
3. Hunt for custom memory-resident backdoors and unauthorized usage of administrative tools (PsExec, WMI) across the domain.
4. Engage specialized Incident Response and coordinate with law enforcement and financial regulatory bodies immediately.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the attack is isolated to a single endpoint; Metel operators always seek Domain Admin privileges.
2. Avoid restoring critical financial servers from backups without ensuring the backups are not also compromised by the persistent backdoor.

References & External Analysis

• Search "metel" on VirusTotal (External Analysis)
• Search "metel" on Any.Run (Sandbox Sandbox)
• Search "metel" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Trojan)

Explore other documented threats in the same operational category:

• Ntkrnl
• Vindor
• Aenjaris
• Zboter
• Pynamer
• Ggdoor
• Zurgop
• Tinukebot

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/metel.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.