Mekotio

Rule Signatures
1

Hi, I propose a rule for the Mekotio banking trojan, which began to appear frequently with this traffic in our sandbox in August.
Malware Reports - Online Malware Analysis Sandbox ← searching by tag

alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] Mekotio Banking Trojan TCP Request";flow: established, to_server;stream_size: client, <, 30; dsize: <29; content: "pimbsbd"; depth: 7;pcre: "/^(?:(?:\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.){3}(?:\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\x0d\x0a/R"; classtype: trojan-activity;reference: md5,b6e0ad4963d054b697f307c09e7eb35f; reference: url,app.any.run/tasks/509940a9-d20a-4599-89e0-40b2810f485d;metadata: malware_family Mekotio, created_at 2023_08_24;sid: 1; rev: 1;)

Best regards, Jane (=^ο½₯ο½ͺο½₯^=))οΎ‰ε½‘β˜†

2 Likes
2

This is awesome! We will get this in for today, thanks Jane!

JT

1 Like
3

2047723 - ET MALWARE [ANY.RUN] Mekotio Banking Trojan TCP Request

Went out in todays release. I made some minor formatting changes but nothing major to match style.

2 Likes