MekotioMalware
Last reported 23 days ago, by ESET WeLiveSecurity (ES)2 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1027.016Junk Code Insertion
“Every served payload differs in variable names, function names, .NET type-name fragmentation, junk-code insertions, XOR keys, and AES-encrypted code blobs, making file-hash detection essentially impossible at population scale (Figure 5).”
- T1053.005Scheduled Task
“The script established persistence by invoking PS_ScheduledTask.ExecMethod(RegisterByUser), which registered a hidden scheduled task configured to execute powershell.exe with -WindowStyle Hidden, -ExecutionPolicy Bypass, and an encoded PowerShell command.”
- T1055Process Injection
“…or remote access trojan (RAT) that splits its capabilities across multiple Add-Type calls to build up a complex functionality like process injection, credential access, and C&C communication modules.”
- T1056.001Keylogging
“Once active, it enables operator-driven fraud through remote input control, keylogging, screen streaming, and Pix QR code interception targeting Brazilian financial institutions.”
- T1684Social Engineering
“Operator can push text popups to the victim screen (social engineering).”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Panorama de ciberamenazas en América Latina: balance del primer semestre de 2026“Otras familias mostraron una distribución segmentada según las particularidades de los sistemas de pago locales: Mispadu, Mekotio, Casbaneiro y variantes dirigidas como Guildma operaron con focalización directa en ecosistemas financieros específicos”
-
Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud“Behaviorally, the operator appears to overlap with the broader Tetrade banking-trojan ecosystem (Grandoreiro, Mekotio, Casbaneiro, Guildma, CHAVECLOAK), though architectural differences suggest it may sit adjacent to rather than within that family.”
Indicators in its reports
named in the reports above- 162.141.111[.]227in 1 report
- hxxps://convitemundial2026[.]com/Consultar_NF-e.batin 1 report
- convitemundial2026[.]comin 1 report
- hxxp://24.199.90[.]58/payload.phpin 1 report
- 24.199.90[.]58in 1 report
- windowsk-cdn[.]comin 1 report
- c.windowsk-cdn[.]comin 1 report
- cdn[.]comin 1 report
- ecdc8fade561a75d…e90ecab1c47fin 1 report
- 38dfeb772afbd01c…23ad06e39d8fin 1 report
- 4912b1134e69ade7…44c6dfcf2ff1in 1 report
- d7545b6dacebdae2…9ba56a70cdaain 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.