Malware

GlitchPOS PoS Malware appears in the cybercrime underground

A new piece of PoS malware appeared in the threat landscape, the malicious code dubbed GlitchPOS has been found on a crimeware forum.

The GlitchPOS malware is able to steal credit card numbers (Track1 and Track2) from the memory of the infected system, it uses a regular expression to perform this task.

The malicious code was discovered by experts from Cisco Talos, the pre-built malware goes for $250, while the builder goes for $600. Experts also found it on alternative websites at a higher price.

The PoS malware first appeared on February 2, the experts assess with high confidence it was developed by a vxer known as Edbitss that a few years ago was distributing the DiamondFox L!NK botnet.

“Cisco Talos recently discovered a new PoS malware that the attackers are selling on a crimeware forum. Our researchers also discovered the associated payloads with the malware, its infrastructure and control panel. ” reads the post published by Talos team.

The GlitchPOS malware is well designed and it is very easy to use, it was distributed via spam messages.

The malware is protected by a packer developed in VisualBasic, it pretends to be a game and the user interface of the main form contains various pictures of cats.

“The purpose of the packer is to decode a library that’s the real payload, encoded with the UPX packer,” continues the analysis.

“Once decoded, we gain access to GlitchPOS, a memory grabber developed in VisualBasic.”

The payload is very small and supports only a few functions, including registering the infected systems, receiving tasks from the C2, exfiltrating credit-card numbers from the memory of the infected systems, and cleaning itself.

The malicious code receives tasks from the C2 server, the commands are executed via a shellcode directly sent by the command and control server.

Researchers suspect that the seller behind GlitchPOS – who goes by the name “Edbitss” – has developed malware before.

Talos team found many similarities between the DiamondFox L!NK botnet and GlitchPOS, such as the malware language and the appearance of the panels (a circumstance that suggests the author reused a portion of code from DiamondFox panel).

“This investigation shows us that POS malware is still attractive and some people are still working on the development of this family of malware.” concludes Talos. “We can see that edbitss developed malware years even after being publicly mentioned by cybersecurity companies. He left DiamondFox to switch on a new project targeting point-of-sale. The sale opened a few weeks ago, so we don’t know yet how many people bought it or use it.”

[adrotate banner=”9″] [adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – GlitchPOS, point-of-sale malware )

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Cisco addressed high-severity flaws in IOS and IOS XE software

Cisco addressed multiple vulnerabilities in IOS and IOS XE software that can be exploited to…

10 hours ago

Google: China dominates government exploitation of zero-day vulnerabilities in 2023

Google's Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively…

16 hours ago

Google addressed 2 Chrome zero-days demonstrated at Pwn2Own 2024

Google addressed two zero-day vulnerabilities in the Chrome web browser that have been demonstrated during…

1 day ago

INC Ransom stole 3TB of data from the National Health Service (NHS) of Scotland

The INC Ransom extortion group hacked the National Health Service (NHS) of Scotland and is threatening…

1 day ago

CISA adds Microsoft SharePoint bug disclosed at Pwn2Own to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Microsoft SharePoint vulnerability disclosed at the…

2 days ago

The DDR Advantage: Real-Time Data Defense

This is the advantage of Data Detection and Response (DDR) for organizations aiming to build…

2 days ago

This website uses cookies.