[Xylitol]

https://www.virustotal.com/en/file/686d ... /analysis/


var_dump() on the gate ?
[syntax="sql"]INSERT INTO `track_storage` (cc, t1, encoding, process, ip, date) VALUES (XYL2K!, 'XYL2K!', 0, 'XYL2K!', '142.4.213.25', null) ON DUPLICATE KEY UPDATE date=now(), encoding=0, t1='XYL2K!', process='XYL2K!', ip = '142.4.213.25' [/syntax]

[rkhunter]

PoSeidon, A Deep Dive Into Point of Sale Malware

http://blogs.cisco.com/security/talos/poseidon

[dhuss]

PoSeidon same as FindPOS covered by Palo Alto: http://researchcenter.paloaltonetworks. ... iscovered/

Some samples attached:
https://www.virustotal.com/en/file/28ca ... /analysis/ - PoSeidon/FindPOS
https://www.virustotal.com/en/file/7b78 ... /analysis/ - Keylogging/LogMeIn Recon as described by Palo Alto

[malwarelabs]

JackPOS.
C&C http://partners-fx.com/jackposprivate12 ... login=true
http://partners-fx.com/jackposprivate12/php.ini -_-

[malwarelabs]

JackPOS again.
Same team, other c&c.
C&C http://masco.com.sa/jackposprivate12/ad ... login=true

[robemtnez]

New POS Malware Emerges - Punkey

https://www.trustwave.com/Resources/Spi ... ---Punkey/

[Blaze]

New POS Malware Emerges - Punkey
https://www.trustwave.com/Resources/Spi ... ---Punkey/

Attached:
0a33332d200e52875c00ea98417b71621b77a9dc291e6a3bdbd69569aac670cf
e0c4696093c71a8bbcd2aef357afca6c7b7fbfe787406f6797636a67ae9b975d

[grum]

FighterPOS :?

http://housecall.trendmicro.com/media/w ... per-en.pdf

http://blog.trendmicro.com.br/fighterpo ... S_xNvCZFdg


https://malwr.com/analysis/MzA2MTdjODVh ... dkMWRmMmY/

Code: Select all

D*\AC:\Users\avanni\Dropbox\BrFighter Bot\Project1.vbp
Microsoft Base Cryptographic Provider v1.0
16006833
69.195.77.74
/BrFighter/
AlE29132913
ArV2m2cGLrjF0s4s
Windows Update
systemroot
\Windows Update
appdata
\InternetExplorer.exe
vbCrLf
bot/command.php?id=

[byte]

Any information to Powerfail - Mic3K V1.10.10 ?
Found it on a WinXP Pos System. I have no sample yet. Maybe later.

[Xylitol]

NitlovePOS: Another New POS Malware ~ https://www.fireeye.com/blog/threat-res ... other.html
https://www.virustotal.com/en/file/0aa4 ... 432469029/
https://www.virustotal.com/en/file/2a1f ... 432469031/