PoS Malware Ultimately Designed to Steal Credit Card Details Through DNS Requests

A new unique PoS malware disguised as a LogMeIn service pack steals magnetic tape payment card data from a wide variety of companies starting from retailers to hotel groups.

Security researchers from Forcepoint spotted an unusual heavy use of UDP-based DNS traffic requests generated by LogMeIn service pack leads to the discovery of UDPoS malware that designed to steal magnetic stripe payment card data. Forcepoint researchers reached out to LogMeIn.

LogMeIn published an advisory states that file or executable is not provided by LogMeIn and updates for LogMeIn products, including patches, updates, etc., will always be delivered securely in-product. You will never be contacted by us with a request to update your software that also includes either an attachment or a link to a new version or update.

Researchers said, “it’s unclear whether the malware is currently being used in campaigns in the wild, although the coordinated use of LogMeIn-themed filenames and C2 URLs, coupled with evidence of an earlier Intel-themed variant, suggest that it may well be”.

Inflection Flow – PoS malware

The malware named as logmeinumon.exe and once it installed it communicates with C&C server and downloads the dropper archive which contains the dropper file update.exe, LogmeinServicePack_5.115.22.001.exe and logmeinumon.exe.

Upon executing update.exe it extracts and sits in temp folder LogmeinServicePack_5.115.22.001.exe which is responsible for placing malware files is automatically triggered.

Once the malware set up is completed it passes over the execution to the monitoring component by launching logmeinumon.exe which is compiled in Visual Studio build and uses string encoding technique.

Also Read MajikPOS Dual malware targeting businesses across North America and Canada

The monitoring component is a multi-threaded application and the code is mainly code is mainly responsible for decrypting and decoding the malware’s internal strings.

Once installation completed it obtains the external IP of the infected machine by using an HTTP request. Once malware executed it generates a batch file called infobat.bat, uses a number of standard Windows commands to create a comprehensive fingerprint of the infected machine Forcepoint published a complete analysis report.

Researchers said “The coding style and techniques seen within the malware can hardly be described as outstanding. Beyond the faulty evasion code noted above, using data files written to disk instead of working predominantly in memory – besides leaving unnecessary trails – is rarely the trademark of bleeding edge malware and, equally, there are more advanced ways of fingerprinting a PC and generating a report.”

IOCS

195453b2dc788d393670db611116dcbc3994a1b4
ba3dc114f848a60f7af83533580b08c682d6f280
d9f58b3c17a2a7b689bb3ed42bce6a5eb7855569
aab16598debb234a9a3732e45d1d1ef369da27d1