Trend Micro was the first to detect MalumPoS in the wild, the new variant was configured to hit this Oracle platform that is widely (330,000 customer installations worldwide) used in the hospitality, food and beverage, and retail industries.
Oracle claims that MICROS is used in 330,000 customer sites worldwide. A bulk of the companies using this platform is mostly concentrated in the United States. If successfully deployed by a threat actor, this PoS RAM scraper could put several high-profile US-based companies and their customers at risk.
MalumPoS belong to the family of PoS RAM scrapers, this means that the malicious agent is able to steal customer credit card data directly from the RAM memory of the infected systems.
The researchers al Trend Micro explained that the MalumPoS was designed to be configurable, its abilities could be easily expanded in the future. The threat actors can change or add other processes or configure new targets.
“He can, for example, configure MalumPoS to include Radiant or NCR Counterpoint PoS systems to its target list.” states the post.
The researchers highlighted the following characteristics of the MalumPoS malware:
NVIDIA disguise: Once installed in a system, MalumPoS disguises itself as “the “NVIDIA Display Driver” or, as seen below, stylized to be displayed as “NVIDIA Display Driv3r”. Although typical NVIDIA components play no important parts in PoS systems, their familiarity to regular users may make the malware seem harmless.
Targeted systems: Aside from Oracle MICROS, MalumPoS also targets Oracle Forms, Shift4 systems, and those accessed via Internet Explorer. Looking at the user base of these listed platforms, we can see that a major chunk is from the US.
Selective credit card scraping:MalumPoS uses regular expressions to sift through PoS data and locate pertinent credit card information. We have seen an older PoS threat called Rdasrv demonstrate the same behavior. In the case of MalumPoS, it selectively looks for any data on the following cards: Visa, MasterCard, American Express, Discover, and Diner’s Club.
Trend Micro have published a detailed analysis of MalumPoS malware that include IoC indicators and YARA rules that could be used to detect the presence of the malware.
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.