"Cherry Picker" PoS Malware Cleans Up After Itself

ronjor · Nov 12, 2015

By Eduard Kovacs on November 12, 2015

A point-of-sale (PoS) malware that went largely undetected for the past several years has been analyzed by researchers at Trustwave.

Dubbed by the security firm “Cherry Picker,” the threat has been around since at least 2011, but it managed to stay under the radar thanks to its sophisticated functionality and use in highly targeted attacks.
Click to expand...

http://www.securityweek.com/cherry-picker-pos-malware-cleans-after-itself

Palancar · Nov 12, 2015

Scary stuff. Wonder if the "chip" technology is going to protect at all against this?

Dermot7 · Nov 17, 2015

For the last five years Trustwave has been monitoring a threat across a number of forensic cases that we have dubbed "Cherry Picker". This targeted Point of Sale (PoS) memory scraper has enjoyed a very low detection rate in the wild for quite some time. Cherry Picker uses a new memory scraping algorithm, a file infector for persistence, and cleaner malware that removes all traces of the infection from target systems. This sophisticated functionality and highly targeted victims have helped the malware remain under the radar of many AV and security companies. This post will expose the functionality of Cherry Picker and hopefully help organizations provide protection from this threat.
Click to expand...

https://www.trustwave.com/Resources...g-the-Spotlight-on-Cherry-Picker-PoS-Malware/

Dermot7 · Nov 17, 2015

Working primarily with point of sale malware, we regularly see the telltale signs of scraping memory for Card Holder Data (CHD). Open up the process, walk through the memory using VirtualQuery, check for numbers between 3 and 6… You know the drill, it's pretty much "the way it's done". Yesterday we posted a blog about Cherry Picker malware. In my first pass through the malware, I found the credit card searching algorithm and glazed over the details while I finished the write up for the forensic team. At that point I realized that I did not see how memory had been accessed. Following the function calls led me to a new technique for scraping memory using the Windows API QueryWorkingSet. Raising awareness of this method can help Antivirus companies and security researchers detect future threats that use this new technique.
Click to expand...

https://www.trustwave.com/Resources...aping-Technique-in-Cherry-Picker-PoS-Malware/

Log in or Sign up

"Cherry Picker" PoS Malware Cleans Up After Itself

ronjor Global Moderator

Palancar Registered Member

Dermot7 Registered Member

Dermot7 Registered Member

Log in or Sign up

"Cherry Picker" PoS Malware Cleans Up After Itself

ronjor Global Moderator

Palancar Registered Member

Dermot7 Registered Member

Dermot7 Registered Member

Useful Searches