SYMBOLCOMMON_NAMEaka. SYNONYMS
win.grateful_pos (Back to overview)

Grateful POS

aka: FrameworkPOS, SCRAPMINT, trinity

Actor(s): Skeleton Spider, FIN6


POS malware targets systems that run physical point-of-sale device and operates by inspecting the process memory for data that matches the structure of credit card data (Track1 and Track2 data), such as the account number, expiration date, and other information stored on a card’s magnetic stripe. After the cards are first scanned, the personal account number (PAN) and accompanying data sit in the point-of-sale system’s memory unencrypted while the system determines where to send it for authorization.
Masked as the LogMein software, the GratefulPOS malware appears to have emerged during the fall 2017 shopping season with low detection ratio according to some of the earliest detections displayed on VirusTotal. The first sample was upload in November 2017. Additionally, this malware appears to be related to the Framework POS malware, which was linked to some of the high-profile merchant breaches in the past.

References
2021SecureworksSecureWorks
@online{secureworks:2021:threat:c0ba914, author = {SecureWorks}, title = {{Threat Profile: GOLD FRANKLIN}}, date = {2021}, organization = {Secureworks}, url = {http://www.secureworks.com/research/threat-profiles/gold-franklin}, language = {English}, urldate = {2021-05-31} } Threat Profile: GOLD FRANKLIN
Grateful POS Meterpreter MimiKatz RemCom FIN6
2020-03-03PWC UKPWC UK
@techreport{uk:20200303:cyber:1f1eef0, author = {PWC UK}, title = {{Cyber Threats 2019:A Year in Retrospect}}, date = {2020-03-03}, institution = {PWC UK}, url = {https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf}, language = {English}, urldate = {2020-03-03} } Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare Axiom
2020-02-19FireEyeFireEye
@online{fireeye:20200219:mtrends:193613a, author = {FireEye}, title = {{M-Trends 2020}}, date = {2020-02-19}, organization = {FireEye}, url = {https://content.fireeye.com/m-trends/rpt-m-trends-2020}, language = {English}, urldate = {2020-02-20} } M-Trends 2020
Cobalt Strike Grateful POS LockerGoga QakBot TrickBot
2020-02-13QianxinQi Anxin Threat Intelligence Center
@techreport{center:20200213:report:146d333, author = {Qi Anxin Threat Intelligence Center}, title = {{APT Report 2019}}, date = {2020-02-13}, institution = {Qianxin}, url = {https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf}, language = {English}, urldate = {2020-02-27} } APT Report 2019
Chrysaor Exodus Dacls elf.vpnfilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy
2019-12-23Norfolk
@online{norfolk:20191223:pos:5862d6d, author = {Norfolk}, title = {{POS Malware Used at Fuel Pumps}}, date = {2019-12-23}, url = {https://norfolkinfosec.com/pos-malware-used-at-fuel-pumps/}, language = {English}, urldate = {2020-01-07} } POS Malware Used at Fuel Pumps
Grateful POS
2019-12VISAVisa Security Alert
@techreport{alert:201912:cybercrime:b12d39c, author = {Visa Security Alert}, title = {{Cybercrime Groups (FIN8) Targeting Fuel Dispenser Merchants}}, date = {2019-12}, institution = {VISA}, url = {https://usa.visa.com/dam/VCOM/global/support-legal/documents/cybercrime-groups-targeting-fuel-dispenser-merchants.pdf}, language = {English}, urldate = {2020-07-23} } Cybercrime Groups (FIN8) Targeting Fuel Dispenser Merchants
Grateful POS
2019-05-01Red CanaryTony Lambert
@online{lambert:20190501:frameworkpos:376a823, author = {Tony Lambert}, title = {{FrameworkPOS and the adequate persistent threat}}, date = {2019-05-01}, organization = {Red Canary}, url = {https://redcanary.com/blog/frameworkpos-and-the-adequate-persistent-threat/}, language = {English}, urldate = {2020-01-29} } FrameworkPOS and the adequate persistent threat
Grateful POS
2017-12-13Vitali Kremez BlogVitali Kremez
@online{kremez:20171213:update:50a1f16, author = {Vitali Kremez}, title = {{Update: Let's Learn: Reversing FIN6 "GratefulPOS" aka "FrameworkPOS" Point-of-Sale Malware in-Depth}}, date = {2017-12-13}, organization = {Vitali Kremez Blog}, url = {http://www.vkremez.com/2017/12/lets-learn-reversing-grateful-point-of.html}, language = {English}, urldate = {2020-01-08} } Update: Let's Learn: Reversing FIN6 "GratefulPOS" aka "FrameworkPOS" Point-of-Sale Malware in-Depth
Grateful POS
2017-12-08RSAKent Beckman
@online{beckman:20171208:gratefulpos:0ba1053, author = {Kent Beckman}, title = {{GratefulPOS credit card stealing malware - just in time for the shopping season}}, date = {2017-12-08}, organization = {RSA}, url = {https://community.rsa.com/community/products/netwitness/blog/2017/12/08/gratefulpos-credit-card-stealing-malware-just-in-time-for-the-shopping-season}, language = {English}, urldate = {2020-01-08} } GratefulPOS credit card stealing malware - just in time for the shopping season
Grateful POS
2016-04FireEyeFireEye
@techreport{fireeye:201604:follow:5df2e81, author = {FireEye}, title = {{Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6}}, date = {2016-04}, institution = {FireEye}, url = {https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf}, language = {English}, urldate = {2020-04-23} } Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6
Grateful POS FIN6
Yara Rules
[TLP:WHITE] win_grateful_pos_auto (20210616 | Detects win.grateful_pos.)
rule win_grateful_pos_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-06-10"
        version = "1"
        description = "Detects win.grateful_pos."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grateful_pos"
        malpedia_rule_date = "20210604"
        malpedia_hash = "be09d5d71e77373c0f538068be31a2ad4c69cfbd"
        malpedia_version = "20210616"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 7407 b8f6ffffff eb02 33c0 }
            // n = 4, score = 600
            //   7407                 | je                  9
            //   b8f6ffffff           | mov                 eax, 0xfffffff6
            //   eb02                 | jmp                 4
            //   33c0                 | xor                 eax, eax

        $sequence_1 = { b8feffffff eb1a b8fdffffff eb13 b8fcffffff eb0c }
            // n = 6, score = 600
            //   b8feffffff           | mov                 eax, 0xfffffffe
            //   eb1a                 | jmp                 0x1c
            //   b8fdffffff           | mov                 eax, 0xfffffffd
            //   eb13                 | jmp                 0x15
            //   b8fcffffff           | mov                 eax, 0xfffffffc
            //   eb0c                 | jmp                 0xe

        $sequence_2 = { e8???????? 99 b980ee3600 f7f9 }
            // n = 4, score = 600
            //   e8????????           |                     
            //   99                   | cdq                 
            //   b980ee3600           | mov                 ecx, 0x36ee80
            //   f7f9                 | idiv                ecx

        $sequence_3 = { 83f801 7510 e8???????? e8???????? }
            // n = 4, score = 600
            //   83f801               | cmp                 eax, 1
            //   7510                 | jne                 0x12
            //   e8????????           |                     
            //   e8????????           |                     

        $sequence_4 = { eb07 b8fcffffff eb02 33c0 }
            // n = 4, score = 600
            //   eb07                 | jmp                 9
            //   b8fcffffff           | mov                 eax, 0xfffffffc
            //   eb02                 | jmp                 4
            //   33c0                 | xor                 eax, eax

        $sequence_5 = { 7411 e8???????? e8???????? 33c0 e9???????? }
            // n = 5, score = 600
            //   7411                 | je                  0x13
            //   e8????????           |                     
            //   e8????????           |                     
            //   33c0                 | xor                 eax, eax
            //   e9????????           |                     

        $sequence_6 = { 0395f8fffdff c1ea03 8b4508 8b4810 0fb63411 8b85f4fffdff }
            // n = 6, score = 500
            //   0395f8fffdff         | imul                ecx, ecx, 0x3e
            //   c1ea03               | add                 esp, 4
            //   8b4508               | push                eax
            //   8b4810               | mov                 eax, dword ptr [ebp + 0x10]
            //   0fb63411             | push                eax
            //   8b85f4fffdff         | mov                 ecx, dword ptr [ebp - 0x694]

        $sequence_7 = { 751e c705????????00000000 68a0680600 6a00 68???????? e8???????? }
            // n = 6, score = 500
            //   751e                 | jne                 0x20
            //   c705????????00000000     |     
            //   68a0680600           | push                0x668a0
            //   6a00                 | push                0
            //   68????????           |                     
            //   e8????????           |                     

        $sequence_8 = { 8bec 51 0fb6450c 33d2 b908000000 f7f1 88550c }
            // n = 7, score = 500
            //   8bec                 | jmp                 0x1c
            //   51                   | mov                 eax, 0xfffffffc
            //   0fb6450c             | cmp                 eax, 1
            //   33d2                 | jne                 0x12
            //   b908000000           | xor                 eax, 0x4d
            //   f7f1                 | mov                 byte ptr [ebp - 0xf], al
            //   88550c               | mov                 ecx, 1

        $sequence_9 = { 898558f9ffff 83bd58f9ffff00 0f85a5080000 a0???????? }
            // n = 4, score = 500
            //   898558f9ffff         | mov                 eax, dword ptr [ebp + 8]
            //   83bd58f9ffff00       | mov                 ecx, dword ptr [eax + 0x10]
            //   0f85a5080000         | movzx               esi, byte ptr [ecx + edx]
            //   a0????????           |                     

        $sequence_10 = { 0f8dbe000000 c785c0fbffff00000000 eb0f 8b8dc0fbffff }
            // n = 4, score = 500
            //   0f8dbe000000         | div                 ecx
            //   c785c0fbffff00000000     | mov    byte ptr [ebp + 0xc], dl
            //   eb0f                 | add                 edx, dword ptr [ebp - 0x20008]
            //   8b8dc0fbffff         | shr                 edx, 3

        $sequence_11 = { 83c404 50 8b4510 50 8b8d6cf9ffff c1e10a }
            // n = 6, score = 500
            //   83c404               | mov                 eax, 0xfffffffc
            //   50                   | jmp                 9
            //   8b4510               | xor                 eax, eax
            //   50                   | mov                 eax, 0xfffffffe
            //   8b8d6cf9ffff         | jmp                 0x1c
            //   c1e10a               | mov                 eax, 0xfffffffd

        $sequence_12 = { 8b45e8 50 ff15???????? 85c0 750e 8b4de8 51 }
            // n = 7, score = 500
            //   8b45e8               | shl                 ecx, 0xa
            //   50                   | mov                 ebp, esp
            //   ff15????????         |                     
            //   85c0                 | push                ecx
            //   750e                 | movzx               eax, byte ptr [ebp + 0xc]
            //   8b4de8               | xor                 edx, edx
            //   51                   | mov                 ecx, 8

        $sequence_13 = { 8bb56cf9ffff c1e60a 8b856cf9ffff c1e00a 05???????? 50 }
            // n = 6, score = 500
            //   8bb56cf9ffff         | mov                 esi, dword ptr [ebp - 0x694]
            //   c1e60a               | shl                 esi, 0xa
            //   8b856cf9ffff         | mov                 eax, dword ptr [ebp - 0x694]
            //   c1e00a               | shl                 eax, 0xa
            //   05????????           |                     
            //   50                   | push                eax

        $sequence_14 = { 8bc2 0500dd6d00 89442450 8b4c2450 e8???????? e9???????? }
            // n = 6, score = 200
            //   8bc2                 | lea                 edx, dword ptr [esp + 0x40]
            //   0500dd6d00           | dec                 eax
            //   89442450             | mov                 ecx, dword ptr [esp + 0x4c0]
            //   8b4c2450             | mov                 eax, edx
            //   e8????????           |                     
            //   e9????????           |                     

        $sequence_15 = { e8???????? 837c243800 7e20 c74424400f000000 41b804000000 488d542440 488b8c24c0040000 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   837c243800           | cmp                 dword ptr [esp + 0x38], 0
            //   7e20                 | jle                 0x22
            //   c74424400f000000     | mov                 dword ptr [esp + 0x40], 0xf
            //   41b804000000         | inc                 ecx
            //   488d542440           | mov                 eax, 4
            //   488b8c24c0040000     | dec                 eax

    condition:
        7 of them and filesize < 3964928
}
Download all Yara Rules