The GlitchPOS malware is able to steal credit card numbers (Track1 and Track2) from the memory of the infected system, it uses a regular expression to perform this task.
The malicious code was discovered by experts from Cisco Talos, the pre-built malware goes for $250, while the builder goes for $600. Experts also found it on alternative websites at a higher price.
The PoS malware first appeared on February 2, the experts assess with high confidence it was developed by a
“Cisco Talos recently discovered a new PoS malware that the attackers are selling on a crimeware forum. Our researchers also discovered the associated payloads with the malware, its infrastructure
The malware is protected by a packer developed in VisualBasic, it pretends to be a game and the user interface of the main form contains various pictures of cats.
“The purpose of the packer is to decode a library that’s the real payload, encoded with the UPX packer,” continues the analysis.
“Once decoded, we gain access to GlitchPOS, a memory grabber developed in VisualBasic.”
The payload is very small and supports only a few functions, including registering the infected systems, receiving tasks from the C2,
The malicious code receives tasks from the C2 server, the commands are executed via a
Researchers suspect that the seller behind GlitchPOS – who goes by the name “Edbitss” – has developed malware before.
Talos team found many similarities between the DiamondFox L!NK botnet and
“This investigation shows us that POS malware is still attractive and some people are still working on the development of this family of
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.