Soraya PoS Malware, a new start in criminal ecosystem

Security experts at Arbor Networks have discovered a new type of PoS malware called Soraya that implements memory scraping and Web forms grabbing.

During 2013 security experts have discovered numerous malware targeting point-of-sale systems, BlackPOS, Dexter and vSkymmer are just some example of malicious code detected in the last 12 months. Researchers at Arbor Networks have discovered a new strain of PoS malware called Soraya that can scrape data in the system memory and is able to capture information sent from Web forms, exactly like the popular Zeus banking trojan.

“Our analysis of Soraya revealed that thousands of payment cards have been compromised. We were able to acquire track data from one command and control after the attacker temporarily placed the card data in a publicly accessible location.”

“Our analysis revealed that 65.16% of the payment cards compromised were issued by financial institutions located in the United States.” states the official post on Soraya.

Experts consider Soraya malware similar to Dexter, both steal payment card information scraping data from memory and then transfer it to a remote Command and Control server.

“Track 1 and track 2 data are packaged and sent to the command and control (C2) site using the protocol described below as a “mode 5″ message.”

Like Dexter malware, Soraya assigns to a specific thread the memory scraping for credit card data searching for specific payment  patterns. 

“It does this by creating the mutex POSMainMutex to ensure it is the only thread operating. Every 5 seconds, the thread will iterate through the list of processes with Process32Next(), ignoring system processes” “It does not use regular expresssions, but matches the format code ‘B’, patterns of digit strings, and the standard “^” separator as defined in ISO/IEC 7813.”

Stolen data are typically sold on the underground market to clone credit cards.

A peculiarity of Soraya POS malware is the use of the Luhn algorithm to identify valid credit/debit card numbers, a new technique for memory scraping point-of-sale malware.

“The Luhn algorithm leverages a simple checksum over credit card numbers to ensure that they are valid.” 

Soraya malware represents the evolution of PoS malware thanks its memory scraping capabilities and web form grabbing, security experts believe that future variant will be more sophisticated, probably improving detection avoidance techniques.

“Soraya has clearly taken inspiration from the Dexter and the Zeus families. The ‘split brain’ functionality of both memory scraping and form grabbing is Soraya’s most unique trait. In past campaigns, memory scrapers have been uniquely targeted at point-of-sale devices and form grabbers have been uniquely targeted at online bank users,” close the post.

(Security Affairs –  Soraya, POS)