Thursday, March 28, 2024

PoS Malware Ultimately Designed to Steal Credit Card Details Through DNS Requests

A new unique PoS malware disguised as a LogMeIn service pack steals magnetic tape payment card data from a wide variety of companies starting from retailers to hotel groups.

Security researchers from Forcepoint spotted an unusual heavy use of UDP-based DNS traffic requests generated by LogMeIn service pack leads to the discovery of UDPoS malware that designed to steal magnetic stripe payment card data. Forcepoint researchers reached out to LogMeIn.

LogMeIn published an advisory states that file or executable is not provided by LogMeIn and updates for LogMeIn products, including patches, updates, etc., will always be delivered securely in-product. You will never be contacted by us with a request to update your software that also includes either an attachment or a link to a new version or update.

Researchers said, “it’s unclear whether the malware is currently being used in campaigns in the wild, although the coordinated use of LogMeIn-themed filenames and C2 URLs, coupled with evidence of an earlier Intel-themed variant, suggest that it may well be”.

Inflection Flow – PoS malware

The malware named as logmeinumon.exe and once it installed it communicates with C&C server and downloads the dropper archive which contains the dropper file update.exe, LogmeinServicePack_5.115.22.001.exe and logmeinumon.exe.

Upon executing update.exe it extracts and sits in temp folder LogmeinServicePack_5.115.22.001.exe which is responsible for placing malware files is automatically triggered.

Once the malware set up is completed it passes over the execution to the monitoring component by launching logmeinumon.exe which is compiled in Visual Studio build and uses string encoding technique.

Also Read MajikPOS Dual malware targeting businesses across North America and Canada

The monitoring component is a multi-threaded application and the code is mainly code is mainly responsible for decrypting and decoding the malware’s internal strings.

Once installation completed it obtains the external IP of the infected machine by using an HTTP request. Once malware executed it generates a batch file called infobat.bat, uses a number of standard Windows commands to create a comprehensive fingerprint of the infected machine Forcepoint published a complete analysis report.

Researchers said “The coding style and techniques seen within the malware can hardly be described as outstanding. Beyond the faulty evasion code noted above, using data files written to disk instead of working predominantly in memory – besides leaving unnecessary trails – is rarely the trademark of bleeding edge malware and, equally, there are more advanced ways of fingerprinting a PC and generating a report.”

IOCS

195453b2dc788d393670db611116dcbc3994a1b4
ba3dc114f848a60f7af83533580b08c682d6f280
d9f58b3c17a2a7b689bb3ed42bce6a5eb7855569
aab16598debb234a9a3732e45d1d1ef369da27d1
Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles