# Mekotio

**URL:** <https://community.emergingthreats.net/t/mekotio/895>\
**Category:** Rule Signatures\
**Created:** [August 24, 2023, 9:14am UTC](https://community.emergingthreats.net/t/mekotio/895 "2023-08-24T09:14:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\
**Post date:** [August 24, 2023, 9:14am UTC](https://community.emergingthreats.net/t/mekotio/895/1 "2023-08-24T09:14:34Z")

</div>

Hi, I propose a rule for the Mekotio banking trojan, which began to appear frequently with this traffic in our sandbox in August.  
[Malware Reports - Online Malware Analysis Sandbox](https://app.any.run/submissions/#tag:mekotio) ← searching by tag

```auto
alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] Mekotio Banking Trojan TCP Request";flow: established, to_server;stream_size: client, <, 30; dsize: <29; content: "pimbsbd"; depth: 7;pcre: "/^(?:(?:\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.){3}(?:\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\x0d\x0a/R"; classtype: trojan-activity;reference: md5,b6e0ad4963d054b697f307c09e7eb35f; reference: url,app.any.run/tasks/509940a9-d20a-4599-89e0-40b2810f485d;metadata: malware_family Mekotio, created_at 2023_08_24;sid: 1; rev: 1;)

```

Best regards, Jane (=^･ｪ･^=))ﾉ彡☆

---

<div class="post-metadata">

**Author:** ![jtaylor](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jtaylor/32/12_2.png) [@jtaylor](https://community.emergingthreats.net/u/jtaylor)\
**Post date:** [August 24, 2023, 2:39pm UTC](https://community.emergingthreats.net/t/mekotio/895/2 "2023-08-24T14:39:29Z")

</div>

This is awesome! We will get this in for today, thanks Jane!

JT

---

<div class="post-metadata">

**Author:** ![jtaylor](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jtaylor/32/12_2.png) [@jtaylor](https://community.emergingthreats.net/u/jtaylor)\
**Post date:** [August 24, 2023, 9:21pm UTC](https://community.emergingthreats.net/t/mekotio/895/3 "2023-08-24T21:21:07Z")

</div>

2047723 - ET MALWARE [ANY.RUN] Mekotio Banking Trojan TCP Request

Went out in todays release. I made some minor formatting changes but nothing major to match style.