Thursday, April 18, 2024

PoS Malware Ultimately Designed to Steal Credit Card Details Through DNS Requests

A new unique PoS malware disguised as a LogMeIn service pack steals magnetic tape payment card data from a wide variety of companies starting from retailers to hotel groups.

Security researchers from Forcepoint spotted an unusual heavy use of UDP-based DNS traffic requests generated by LogMeIn service pack leads to the discovery of UDPoS malware that designed to steal magnetic stripe payment card data. Forcepoint researchers reached out to LogMeIn.

LogMeIn published an advisory states that file or executable is not provided by LogMeIn and updates for LogMeIn products, including patches, updates, etc., will always be delivered securely in-product. You will never be contacted by us with a request to update your software that also includes either an attachment or a link to a new version or update.

Researchers said, “it’s unclear whether the malware is currently being used in campaigns in the wild, although the coordinated use of LogMeIn-themed filenames and C2 URLs, coupled with evidence of an earlier Intel-themed variant, suggest that it may well be”.

Inflection Flow – PoS malware

The malware named as logmeinumon.exe and once it installed it communicates with C&C server and downloads the dropper archive which contains the dropper file update.exe, LogmeinServicePack_5.115.22.001.exe and logmeinumon.exe.

Upon executing update.exe it extracts and sits in temp folder LogmeinServicePack_5.115.22.001.exe which is responsible for placing malware files is automatically triggered.

Once the malware set up is completed it passes over the execution to the monitoring component by launching logmeinumon.exe which is compiled in Visual Studio build and uses string encoding technique.

Also Read MajikPOS Dual malware targeting businesses across North America and Canada

The monitoring component is a multi-threaded application and the code is mainly code is mainly responsible for decrypting and decoding the malware’s internal strings.

Once installation completed it obtains the external IP of the infected machine by using an HTTP request. Once malware executed it generates a batch file called infobat.bat, uses a number of standard Windows commands to create a comprehensive fingerprint of the infected machine Forcepoint published a complete analysis report.

Researchers said “The coding style and techniques seen within the malware can hardly be described as outstanding. Beyond the faulty evasion code noted above, using data files written to disk instead of working predominantly in memory – besides leaving unnecessary trails – is rarely the trademark of bleeding edge malware and, equally, there are more advanced ways of fingerprinting a PC and generating a report.”



Latest articles

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a...

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber...

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent...

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure...

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...

Outlook Login Panel Themed Phishing Attack Evaded All Antivirus Detections

Cybersecurity researchers have uncovered a new phishing attack that has bypassed all antivirus detections.The...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles