... Sale) machines. This code demonstrates the most used technique to 'scrape' RAM. This exact technique was used in the Target credit card heist by BlackPOS. https://github.com/joren485/RamScraper Have you read topic title before posting this copy-paste from win32 pos? @boos If they ever exists ...

... Sale) machines. This code demonstrates the most used technique to 'scrape' RAM. This exact technique was used in the Target credit card heist by BlackPOS. https://github.com/joren485/RamScraper

Hi,

Are we all 'happy' that BlackPOS v2 is a 'real thing' and not just a hand waving argument that this or that sample is too different from BlackPOS?

Regards

Simon

The sample referenced by TrendMicro isn't BlackPOS. I wasn't going to call them out on it publicly, but then Krebs started grasping at straws and now everyone thinks it's BlackPOS v2. http://blog.nuix.com/2014/09/08/blackpos-v2-new-variant-or-different-family/ ...

A lot of folks are calling this BlackPoS. The main basis for this is the unique-exfiltration techniques.

The t.bat file that is decoded from the Trend posting, uses a bitshift & XOR key.

http://blog.trendmicro.com/trendlabs-security-intelligence/new-blackpos-malware-emerges-in-the-wild-targets-retail-accounts/ http://blog.trendmicro.com/trendlabs-security-intelligence/files/2014/08/fig4_blackpos.jpg old or new tricks by BlackPOS? I like ...

http://blog.trendmicro.com/trendlabs-se ... -accounts/



old or new tricks by BlackPOS?

KAPTOXA samples

ESET: Win32/Spy.POSCardStealer.R, Win32/Spy.POSCardStealer.S, Win32/Spy.POSCardStealer.T
MS: Trojan:Win32/Ploscato.A, Trojan:Win32/Ploscato.B
Symantec: Infostealer.Reedum.B
iSight: Trojan.POSRAM
or just another modification of BlackPOS

IntelCrawler: "17-years-old teenager is the author of BlackPOS/Kaptoxa malware (Target), several other breaches may be revealed soon"

http://intelcrawler.com/about/press08
http://www.kernelmode.info/forum/search ... s=BlackPOS

BlackPOS: https://www.virustotal.com/en/file/19d347e83cd26cb7ef38ce4bd00ed248c1db2f2cb05dedd1f2c4007f128ad9be/analysis/1370434975/ https://www.virustotal.com/en/file/12643ca8c088f9abc43843fe9f5e527db8033057b7148a56a798de9bf6a9cf13/analysis/1370434985/ ...