[N3mes1s]

Yara Rules for POS Malware:
https://github.com/sysforensics/Yara/bl ... lware.yara

[rkhunter]

ook, it's all about KAPTOXA POS malware

KAPTOXA POS Report – Released Jan. 16, 2014
https://www.isightpartners.com/2014/01/ ... eport-faq/

Could a Novell vulnerability be behind the Target breach?
http://www.webroot.com/blog/2014/01/17/ ... et-breach/

A Closer Look at the Target Malware
http://krebsonsecurity.com/2014/01/a-fi ... n-malware/
http://krebsonsecurity.com/2014/01/a-cl ... e-part-ii/

http://artemonsecurity.com/20140116_POS ... alysis.pdf

[rkhunter]

KAPTOXA samples

ESET: Win32/Spy.POSCardStealer.R, Win32/Spy.POSCardStealer.S, Win32/Spy.POSCardStealer.T
MS: Trojan:Win32/Ploscato.A, Trojan:Win32/Ploscato.B
Symantec: Infostealer.Reedum.B
iSight: Trojan.POSRAM
or just another modification of BlackPOS

[Xylitol]

Target POS malware author reveals himself ~ http://www.net-security.org/malware_news.php?id=2683
http://translate.google.com/translate?s ... s%2F125806

[hx1997]

VBS/Spy.POSCardStealer.A and Win32/Spy.POSCardStealer.U

[bsteo]

Look mom, I'm famous, lol :)

Code: Select all

sListaNeagra(26) = "4744870016311111" 'exitthematrix pos trigger

Inside Decebal src posted above.

[Xylitol]

Decebal coder is retarded.
4744870016311111 is invalid luhn and the procedure behind check if the number is luhn valid so he don't even need to put this one on the 'blacklist' in theory.

[bsteo]

Decebal coder is retarded.
4744870016311111 is invalid luhn and the procedure behind check if the number is luhn valid so he don't even need to put this one on the 'blacklist' in theory.

Agree, he doesn't even have a real LUHN procedure to check, only the name.

[Xylitol]

Alina 7: https://www.virustotal.com/en/file/cd96 ... 391011632/
ProjectHook 2: https://www.virustotal.com/en/file/437a ... 391011614/

[bsteo]

Any good info/sample on new 'ChewBacca'?

MD5: 21f8b9d9a6fa3a0cd3a3f0644636bf09

https://blogs.rsa.com/rsa-uncovers-new- ... formation/
https://www.securelist.com/en/blog/2082 ... ed_Malware
http://threatpost.com/chewbacca-point-o ... ies/103985
http://thehackernews.com/2013/12/resear ... w-tor.html
http://thehackernews.com/2014/01/tor-en ... lware.html

EDIT: oops, found it :)

http://www.kernelmode.info/forum/viewto ... cca#p21741