[Xylitol]

Win32/Spy.POSCardStealer.K (vSkimmer)
https://www.virustotal.com/fr/file/e3f4 ... 363248755/
https://www.virustotal.com/fr/file/5560 ... 363251105/

Code: Select all

hxxp://gmxdotkomlive.ru/api/_admin/index.php?u=admin
203.142.16.41

locs:

Code: Select all

http://ajutorpc.ro/Order.zip
http://photoscrapz.com/Order.zip
http://www.carduelis.gr/Order.zip
http://hipospadias.ro/Order.zip
http://uretroplastii.ro/Order.zip
http://www.designtg.web4hosting.pl/Order.zip

[Xylitol]

Win32/Spy.POSCardStealer.L
Come from:

Code: Select all

royjamesinsurance.com/images/cisco1.exe
royjamesinsurance.com/images/cisco0.exe

9f456687aad8d329e347fb00fe01e6b4 - VT: 2/46
a3224de91bab9d0c22498853de86808d - VT: 2/46

[p4r4n0id]

Dump Memory Grabber - http://www.securityweek.com/exclusive-n ... r-us-banks

http://darkmoney.cc/kuplya-prodazha-36/ ... ojan-5117/

sample anyone?

[bsteo]

Dump Memory Grabber - http://www.securityweek.com/exclusive-n ... r-us-banks

http://darkmoney.cc/kuplya-prodazha-36/ ... ojan-5117/

sample anyone?

Not much info. Found any MD5 hash of some binary?

[grum]

:D video working
Dump Memory Grabber bot


http://goo.gl/AEZrE
http://goo.gl/NJQau

[p4r4n0id]

Dump Memory Grabber - http://www.securityweek.com/exclusive-n ... r-us-banks

http://darkmoney.cc/kuplya-prodazha-36/ ... ojan-5117/

sample anyone?

Not much info. Found any MD5 hash of some binary?

No, still looking for....

[Xylitol]

Win32/Spy.POSCardStealer.M

Code: Select all

loc: hxxp://robertwindpony.com/small.exe

https://www.virustotal.com/fr/file/fd05 ... 364822459/

[Xylitol]

Win32/Spy.POSCardStealer.N (Ree4 Dump Memory Grabber)
https://www.virustotal.com/fr/file/7453 ... 365001507/
https://www.virustotal.com/en/file/8ca0 ... 365001512/
panel at ree4.7ci.ru/dus.php
very weak at all.

[HackedPOS]

VISA Sent out a Data Security Alert regarding memory-parsing POS malware:

http://www.scribd.com/doc/136739426/ALE ... s-04112013

[bsteo]

VISA Sent out a Data Security Alert regarding memory-parsing POS malware:

http://www.scribd.com/doc/136739426/ALE ... s-04112013

Any samples from those hashes in the doc?