The GlitchPOS malware is able to steal credit card numbers (Track1 and Track2) from the memory of the infected system, it uses a regular expression to perform this task.
The malicious code was discovered by experts from Cisco Talos, the pre-built malware goes for $250, while the builder goes for $600. Experts also found it on alternative websites at a higher price.
The PoS malware first appeared on February 2, the experts assess with high confidence it was developed by a
“Cisco Talos recently discovered a new PoS malware that the attackers are selling on a crimeware forum. Our researchers also discovered the associated payloads with the malware, its infrastructure
The malware is protected by a packer developed in VisualBasic, it pretends to be a game and the user interface of the main form contains various pictures of cats.
“The purpose of the packer is to decode a library that’s the real payload, encoded with the UPX packer,” continues the analysis.
“Once decoded, we gain access to GlitchPOS, a memory grabber developed in VisualBasic.”
The payload is very small and supports only a few functions, including registering the infected systems, receiving tasks from the C2,
The malicious code receives tasks from the C2 server, the commands are executed via a
Researchers suspect that the seller behind GlitchPOS – who goes by the name “Edbitss” – has developed malware before.
Talos team found many similarities between the DiamondFox L!NK botnet and
“This investigation shows us that POS malware is still attractive and some people are still working on the development of this family of