1. Home
  2. Software
  3. RawPOS

RawPOS

RawPOS is a point-of-sale (POS) malware family that searches for cardholder data on victims. It has been in use since at least 2008. [1] [2] [3] FireEye divides RawPOS into three components: FIENDCRY, DUEBREW, and DRIFTWOOD. [4] [5]

ID: S0169
ⓘ
Associated Software: FIENDCRY, DUEBREW, DRIFTWOOD
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Contributors: Walker Johnson
Version: 1.1
Created: 16 January 2018
Last Modified: 30 March 2020
Version Permalink

Associated Software Descriptions

Name Description
FIENDCRY

The FIENDCRY component is a memory scraper based on MemPDump that scans through process memory looking for regular expressions. Its stage 1 component scans all processes, and its stage 2 component targets a specific process of interest. [4] [6] [5]
DUEBREW

The DUEBREW component is a Perl2Exe binary launcher. [4] [5]
DRIFTWOOD

The DRIFTWOOD component is a Perl2Exe compiled Perl script used by G0053 after they have identified data of interest on victims. [4] [5]
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1560 .003 Archive Collected Data: Archive via Custom Method

RawPOS encodes credit card data it collected from the victim with XOR.[2][4][3]
Enterprise T1543 .003 Create or Modify System Process: Windows Service

RawPOS installs itself as a service to maintain persistence.[1][2][4]
Enterprise T1005 Data from Local System

RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.[1][2][4]
Enterprise T1074 .001 Data Staged: Local Data Staging

Data captured by RawPOS is placed in a temporary file under a directory named "memdump".[1]
Enterprise T1036 .004 Masquerading: Masquerade Task or Service

New services created by RawPOS are made to appear like legitimate Windows services, with names such as "Windows Management Help Service", "Microsoft Support", and "Windows Advanced Task Manager".[1][2][4]

Groups That Use This Software

ID Name References
G0053 FIN5

[5][4]

References

  1. Nesbit, B. and Ackerman, D. (2017, January). Malware Analysis Report - RawPOS Malware: Deconstructing an Intruder’s Toolkit. Retrieved October 4, 2017.
  2. TrendLabs Security Intelligence Blog. (2015, April). RawPOS Technical Brief. Retrieved October 4, 2017.
  3. Visa. (2015, March). Visa Security Alert: "RawPOS" Malware Targeting Lodging Merchants. Retrieved October 6, 2017.
  1. Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.
  2. Higgins, K. (2015, October 13). Prolific Cybercrime Gang Favors Legit Login Credentials. Retrieved October 4, 2017.
  3. DiabloHorn. (2015, March 22). mempdump. Retrieved October 6, 2017.