Categories: Cyber CrimeMalware

Soraya PoS Malware, a new start in criminal ecosystem

Security experts at Arbor Networks have discovered a new type of PoS malware called Soraya that implements memory scraping and Web forms grabbing.

During 2013 security experts have discovered numerous malware targeting point-of-sale systems, BlackPOS, Dexter and vSkymmer are just some example of malicious code detected in the last 12 months. Researchers at Arbor Networks have discovered a new strain of PoS malware called Soraya that can scrape data in the system memory and is able to capture information sent from Web forms, exactly like the popular Zeus banking trojan.

“Our analysis of Soraya revealed that thousands of payment cards have been compromised. We were able to acquire track data from one command and control after the attacker temporarily placed the card data in a publicly accessible location.”

“Our analysis revealed that 65.16% of the payment cards compromised were issued by financial institutions located in the United States.” states the official post on Soraya.

Experts consider Soraya malware similar to Dexter, both steal payment card information scraping data from memory and then transfer it to a remote Command and Control server.

“Track 1 and track 2 data are packaged and sent to the command and control (C2) site using the protocol described below as a “mode 5″ message.”

Like Dexter malware, Soraya assigns to a specific thread the memory scraping for credit card data searching for specific payment  patterns. 

“It does this by creating the mutex POSMainMutex to ensure it is the only thread operating. Every 5 seconds, the thread will iterate through the list of processes with Process32Next(), ignoring system processes” “It does not use regular expresssions, but matches the format code ‘B’, patterns of digit strings, and the standard “^” separator as defined in ISO/IEC 7813.”

Stolen data are typically sold on the underground market to clone credit cards.

A peculiarity of Soraya POS malware is the use of the Luhn algorithm to identify valid credit/debit card numbers, a new technique for memory scraping point-of-sale malware.

“The Luhn algorithm leverages a simple checksum over credit card numbers to ensure that they are valid.” 

Soraya malware represents the evolution of PoS malware thanks its memory scraping capabilities and web form grabbing, security experts believe that future variant will be more sophisticated, probably improving detection avoidance techniques.

“Soraya has clearly taken inspiration from the Dexter and the Zeus families. The ‘split brain’ functionality of both memory scraping and form grabbing is Soraya’s most unique trait. In past campaigns, memory scrapers have been uniquely targeted at point-of-sale devices and form grabbers have been uniquely targeted at online bank users,” close the post.

(Security Affairs –  Soraya, POS)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Google addressed 2 Chrome zero-days demonstrated at Pwn2Own 2024

Google addressed two zero-day vulnerabilities in the Chrome web browser that have been demonstrated during…

8 hours ago

INC Ransom stole 3TB of data from the National Health Service (NHS) of Scotland

The INC Ransom extortion group hacked the National Health Service (NHS) of Scotland and is threatening…

12 hours ago

CISA adds Microsoft SharePoint bug disclosed at Pwn2Own to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Microsoft SharePoint vulnerability disclosed at the…

17 hours ago

The DDR Advantage: Real-Time Data Defense

This is the advantage of Data Detection and Response (DDR) for organizations aiming to build…

20 hours ago

Finnish police linked APT31 to the 2021 parliament attack

The Finnish Police attributed the attack against the parliament that occurred in March 2021 to…

1 day ago

TheMoon bot infected 40,000 devices in January and February

A new variant of TheMoon malware infected thousands of outdated small office and home office…

1 day ago

This website uses cookies.