{"id":10,"date":"2021-12-21T22:48:54","date_gmt":"2021-12-21T22:48:54","guid":{"rendered":"https:\/\/blog.scilabs.mx\/en\/?p=10"},"modified":"2021-12-21T22:48:54","modified_gmt":"2021-12-21T22:48:54","slug":"mekotio-distribution-campaign-targeting-latam","status":"publish","type":"post","link":"https:\/\/blog.scilabs.mx\/en\/2021\/12\/21\/mekotio-distribution-campaign-targeting-latam\/","title":{"rendered":"Mekotio distribution campaign targeting LATAM"},"content":{"rendered":"\n

Overview<\/a><\/h2>\n\n

 <\/p>\n\n

The following report describes the identified TTPs and IOCs of a campaign that is distributing the Mekotio banking trojan in LATAM. It was identified and analyzed by SCILabs while conducting a threat hunting during the third week of September and has been monitored in the last days by the team. This trojan aims to steal information from multiple banking institutions using fake forms to impersonate original sites and capture bank credentials, in addition the trojan also seeks to hijack cryptocurrency transactions by replacing wallets copied to the clipboard by the cybercriminals’ wallet.<\/p>\n\n

 <\/p>\n\n

During the investigation, no further details were obtained about how this campaign is being delivered; however, based on the evidence collected, SCILabs considers the use of phishing by email and websites as the main initial attack vectors<\/a> with a high level of confidence. On the other hand, this report will show the analysis of each of the elements of the campaign, which, based on the telemetry of SCILabs, its modus operandi supplants the name of Mexican and Chilean tax institutions such as: Secretar\u00eda de Administraci\u00f3n Tributaria<\/em> (SAT<\/em>) and Servicio de Impuestos Internos<\/em> (SII<\/em>), to be used as a pretext in phishing emails.<\/p>\n\n

 <\/p>\n\n

After analyzing the campaign and the artifacts, SCILabs determined with high confidence that the attacker’s general objective is to install the banking Trojan on common users’ machines, to steal user information in LATAM, particularly Chile and Mexico.<\/p>\n\n

 <\/p>\n\n

Additionally, with the intelligence of SCILabs and the information obtained from public and private sources, it is possible to determine that the campaign has the potential to begin to spread in other countries of LATAM, expanding the banking institutions it is targeting due to its versatility and the rapid evolution of its TTPs.<\/p>\n

How could it affect an organization?<\/a><\/h2>\n\n

 <\/p>\n\n

The campaign has the potential to financially affect an organization because Mekotio’s main objective is to steal bank information from users. In addition, during the analysis of the trojan, some capabilities were found to drop other types of malicious artifacts on demand, so, it could be combined with other types of malwares such as ransomware. This could make the organization’s information assets subject to unauthorized viewing, hijacking, and data leakage. Considering that the trojan has evolved its TTPs compared to previous campaigns to make it difficult to detect and analyze, it is important to be aware of these types of threats.<\/p>\n\n

 <\/p>\n\n

Analysis<\/a><\/h2>\n\n

 <\/p>\n\n

Threat Context<\/h3>\n\n

 <\/p>\n\n

During the threat hunting process, three artifacts were identified that share similar behavior. SCILabs analyzed and investigated each of the items to determine if they were part of the same campaign. Based on the research carried out by SCILabs we consider with a high level of confidence, that Mekotio’s distribution campaign in Mexico is by means of phishing email trying to supplant the Secretar\u00eda de Administraci\u00f3n Tributaria<\/em> (SAT<\/em>) and with a medium level of confidence that the campaign directed to Chile is through an apocryphal site of the Servicio de Inpuestos Internos<\/em> (SII<\/em>)<\/a>.<\/p>\n\n

 <\/p>\n\n

\n
\"\"
Figure 1 – Phishing email impersonating the SAT<\/figcaption><\/figure>\n\"\"<\/figure>\n\n

 <\/p>\n\n

 <\/p>\n\n

Attack flow<\/h3>\n\n

 <\/p>\n\n

Campaign directed to Mexico<\/strong><\/h4>\n\n

 <\/p>\n\n

 <\/p>\n\n

Campaign directed to Chile<\/strong><\/h4>\n\n

 <\/p>\n\n

 <\/p>\n\n

Malware analysis<\/h3>\n\n

 <\/p>\n\n

As a result of the analysis of the artifacts carried out, SCILabs determined that the campaigns targeting Mexico and Chile use two different versions of the Mekotio trojan. The main difference between the versions is that the artifact aimed at Chile contains within it the MSI file the three files necessary to run the banking trojan, instead of downloading them as in the version aimed at Mexico, however, they share some capabilities that are listed below:<\/p>\n\n

 <\/p>\n\n