GlitchPOS PoS Malware appears in the cybercrime underground

A new piece of PoS malware appeared in the threat landscape, the malicious code dubbed GlitchPOS has been found on a crimeware forum. The GlitchPOS malware is able to steal credit card numbers (Track1 and Track2) from the memory of the infected system, it uses a regular expression to perform this task. The malicious code […]

March 15, 2019

A new piece of PoS malware appeared in the threat landscape, the malicious code dubbed GlitchPOS has been found on a crimeware forum.

The GlitchPOS malware is able to steal credit card numbers (Track1 and Track2) from the memory of the infected system, it uses a regular expression to perform this task.

The malicious code was discovered by experts from Cisco Talos, the pre-built malware goes for $250, while the builder goes for $600. Experts also found it on alternative websites at a higher price.

The PoS malware first appeared on February 2, the experts assess with high confidence it was developed by a vxer known as Edbitss that a few years ago was distributing the DiamondFox L!NK botnet.

“Cisco Talos recently discovered a new PoS malware that the attackers are selling on a crimeware forum. Our researchers also discovered the associated payloads with the malware, its infrastructure and control panel. ” reads the post published by Talos team.

The GlitchPOS malware is well designed and it is very easy to use, it was distributed via spam messages.

The malware is protected by a packer developed in VisualBasic, it pretends to be a game and the user interface of the main form contains various pictures of cats.

“The purpose of the packer is to decode a library that’s the real payload, encoded with the UPX packer,” continues the analysis.

“Once decoded, we gain access to GlitchPOS, a memory grabber developed in VisualBasic.”

The payload is very small and supports only a few functions, including registering the infected systems, receiving tasks from the C2, exfiltrating credit-card numbers from the memory of the infected systems, and cleaning itself.

The malicious code receives tasks from the C2 server, the commands are executed via a shellcode directly sent by the command and control server.

Researchers suspect that the seller behind GlitchPOS – who goes by the name “Edbitss” – has developed malware before.

Talos team found many similarities between the DiamondFox L!NK botnet and GlitchPOS, such as the malware language and the appearance of the panels (a circumstance that suggests the author reused a portion of code from DiamondFox panel).

“This investigation shows us that POS malware is still attractive and some people are still working on the development of this family of malware.” concludes Talos. “We can see that edbitss developed malware years even after being publicly mentioned by cybersecurity companies. He left DiamondFox to switch on a new project targeting point-of-sale. The sale opened a few weeks ago, so we don’t know yet how many people bought it or use it.”