Grateful POS (Malware Family)

Grateful POS

aka: FrameworkPOS, SCRAPMINT, trinity

Actor(s): Skeleton Spider, FIN6

POS malware targets systems that run physical point-of-sale device and operates by inspecting the process memory for data that matches the structure of credit card data (Track1 and Track2 data), such as the account number, expiration date, and other information stored on a card’s magnetic stripe. After the cards are first scanned, the personal account number (PAN) and accompanying data sit in the point-of-sale system’s memory unencrypted while the system determines where to send it for authorization.
Masked as the LogMein software, the GratefulPOS malware appears to have emerged during the fall 2017 shopping season with low detection ratio according to some of the earliest detections displayed on VirusTotal. The first sample was upload in November 2017. Additionally, this malware appears to be related to the Framework POS malware, which was linked to some of the high-profile merchant breaches in the past.

References

2021 ⋅ Secureworks ⋅ SecureWorks
Threat Profile: GOLD FRANKLIN
Grateful POS Meterpreter MimiKatz RemCom FIN6

2020-03-03 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare APT41 MUSTANG PANDA

2020-02-19 ⋅ FireEye ⋅ FireEye
M-Trends 2020
Cobalt Strike Grateful POS LockerGoga QakBot TrickBot

2020-02-13 ⋅ Qianxin ⋅ Qi Anxin Threat Intelligence Center
APT Report 2019
Chrysaor Exodus Dacls VPNFilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy

2019-12-23 ⋅ Norfolk
POS Malware Used at Fuel Pumps
Grateful POS

2019-12 ⋅ VISA ⋅ Visa Security Alert
Cybercrime Groups (FIN8) Targeting Fuel Dispenser Merchants
Grateful POS

2019-05-01 ⋅ Red Canary ⋅ Tony Lambert
FrameworkPOS and the adequate persistent threat
Grateful POS

2017-12-13 ⋅ Vitali Kremez Blog ⋅ Vitali Kremez
Update: Let's Learn: Reversing FIN6 "GratefulPOS" aka "FrameworkPOS" Point-of-Sale Malware in-Depth
Grateful POS

2017-12-08 ⋅ RSA ⋅ Kent Beckman
GratefulPOS credit card stealing malware - just in time for the shopping season
Grateful POS

2016-04 ⋅ FireEye ⋅ FireEye
Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6
Grateful POS FIN6

Yara Rules

[TLP:WHITE] win_grateful_pos_auto (20230125 | Detects win.grateful_pos.)

rule win_grateful_pos_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.grateful_pos."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grateful_pos"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 7411 e8???????? e8???????? 33c0 e9???????? }
            // n = 5, score = 600
            //   7411                 | je                  0x13
            //   e8????????           |                     
            //   e8????????           |                     
            //   33c0                 | xor                 eax, eax
            //   e9????????           |                     

        $sequence_1 = { eb07 b8fcffffff eb02 33c0 }
            // n = 4, score = 600
            //   eb07                 | jmp                 9
            //   b8fcffffff           | mov                 eax, 0xfffffffc
            //   eb02                 | jmp                 4
            //   33c0                 | xor                 eax, eax

        $sequence_2 = { e8???????? 99 b980ee3600 f7f9 }
            // n = 4, score = 600
            //   e8????????           |                     
            //   99                   | cdq                 
            //   b980ee3600           | mov                 ecx, 0x36ee80
            //   f7f9                 | idiv                ecx

        $sequence_3 = { 7407 b8f6ffffff eb02 33c0 }
            // n = 4, score = 600
            //   7407                 | je                  9
            //   b8f6ffffff           | mov                 eax, 0xfffffff6
            //   eb02                 | jmp                 4
            //   33c0                 | xor                 eax, eax

        $sequence_4 = { e8???????? 83f801 7510 e8???????? e8???????? }
            // n = 5, score = 600
            //   e8????????           |                     
            //   83f801               | cmp                 eax, 1
            //   7510                 | jne                 0x12
            //   e8????????           |                     
            //   e8????????           |                     

        $sequence_5 = { b8feffffff eb1a b8fdffffff eb13 b8fcffffff }
            // n = 5, score = 600
            //   b8feffffff           | mov                 eax, 0xfffffffe
            //   eb1a                 | jmp                 0x1c
            //   b8fdffffff           | mov                 eax, 0xfffffffd
            //   eb13                 | jmp                 0x15
            //   b8fcffffff           | mov                 eax, 0xfffffffc

        $sequence_6 = { e8???????? 83c40c c785d0fbffff00000000 8a15???????? 8855e4 }
            // n = 5, score = 500
            //   e8????????           |                     
            //   83c40c               | lea                 ecx, [esp + 0x50]
            //   c785d0fbffff00000000     | jmp    0xc
            //   8a15????????         |                     
            //   8855e4               | dec                 esp

        $sequence_7 = { eb0f 8b85ccfbffff 83c001 8985ccfbffff 83bdccfbffff45 733e 8b8de0fbffff }
            // n = 7, score = 500
            //   eb0f                 | mov                 ecx, dword ptr [esp + 0xa80]
            //   8b85ccfbffff         | dec                 esp
            //   83c001               | lea                 eax, [0x19e2c]
            //   8985ccfbffff         | mov                 edx, 0x400
            //   83bdccfbffff45       | dec                 eax
            //   733e                 | lea                 ecx, [esp + 0x260]
            //   8b8de0fbffff         | dec                 eax

        $sequence_8 = { 754d 8b8dd4fbffff 0fb6940de4fbffff 83fa30 7c13 8b85d4fbffff }
            // n = 6, score = 500
            //   754d                 | jne                 0x4f
            //   8b8dd4fbffff         | mov                 ecx, dword ptr [ebp - 0x42c]
            //   0fb6940de4fbffff     | movzx               edx, byte ptr [ebp + ecx - 0x41c]
            //   83fa30               | cmp                 edx, 0x30
            //   7c13                 | jl                  0x15
            //   8b85d4fbffff         | mov                 eax, dword ptr [ebp - 0x42c]

        $sequence_9 = { 8b450c 83e83d 50 8b4d08 51 ff15???????? }
            // n = 6, score = 500
            //   8b450c               | mov                 eax, dword ptr [ebp - 0x434]
            //   83e83d               | add                 eax, 1
            //   50                   | mov                 dword ptr [ebp - 0x434], eax
            //   8b4d08               | cmp                 dword ptr [ebp - 0x434], 0x45
            //   51                   | jae                 0x50
            //   ff15????????         |                     

        $sequence_10 = { eb08 83c8ff e9???????? eb8a }
            // n = 4, score = 500
            //   eb08                 | mov                 eax, dword ptr [eax + 0x18]
            //   83c8ff               | mov                 ecx, 8
            //   e9????????           |                     
            //   eb8a                 | dec                 eax

        $sequence_11 = { 8945fc 56 57 6800040000 6a00 68???????? e8???????? }
            // n = 7, score = 500
            //   8945fc               | mov                 ecx, dword ptr [ebp - 0x420]
            //   56                   | jmp                 0xa
            //   57                   | or                  eax, 0xffffffff
            //   6800040000           | jmp                 0xffffff8c
            //   6a00                 | cmp                 dword ptr [ebp - 0x424], 0xf
            //   68????????           |                     
            //   e8????????           |                     

        $sequence_12 = { 83bddcfbffff0f 7d5e 8b95e0fbffff 2b95dcfbffff 0fb602 83f830 7c16 }
            // n = 7, score = 500
            //   83bddcfbffff0f       | div                 ecx
            //   7d5e                 | dec                 eax
            //   8b95e0fbffff         | mov                 ecx, eax
            //   2b95dcfbffff         | add                 esp, 0xc
            //   0fb602               | mov                 dword ptr [ebp - 0x430], 0
            //   83f830               | mov                 byte ptr [ebp - 0x1c], dl
            //   7c16                 | jmp                 0x11

        $sequence_13 = { 85d2 0f85dc000000 eb0f 8b85dcfbffff 83c001 8985dcfbffff 83bddcfbffff46 }
            // n = 7, score = 500
            //   85d2                 | test                edx, edx
            //   0f85dc000000         | jne                 0xe2
            //   eb0f                 | jmp                 0x11
            //   8b85dcfbffff         | mov                 eax, dword ptr [ebp - 0x424]
            //   83c001               | add                 eax, 1
            //   8985dcfbffff         | mov                 dword ptr [ebp - 0x424], eax
            //   83bddcfbffff46       | cmp                 dword ptr [ebp - 0x424], 0x46

        $sequence_14 = { 4c8b8c24800a0000 4c8d052c9e0100 ba00040000 488d8c2460020000 }
            // n = 4, score = 200
            //   4c8b8c24800a0000     | lea                 ecx, [esp + 0x50]
            //   4c8d052c9e0100       | jmp                 4
            //   ba00040000           | dec                 esp
            //   488d8c2460020000     | mov                 ecx, dword ptr [esp + 0xa80]

        $sequence_15 = { 33d2 488bc8 e8???????? 488d4c2450 e8???????? eb02 }
            // n = 6, score = 200
            //   33d2                 | xor                 edx, edx
            //   488bc8               | dec                 eax
            //   e8????????           |                     
            //   488d4c2450           | mov                 ecx, eax
            //   e8????????           |                     
            //   eb02                 | dec                 eax

    condition:
        7 of them and filesize < 3964928
}

Download all Yara Rules

Grateful POS Propose Change

References

Yara Rules

Grateful POS