SYMBOLCOMMON_NAMEaka. SYNONYMS
win.modpipe (Back to overview)

ModPipe

ModPipe is point-of-sale (POS) malware capable of accessing sensitive information stored in devices running ORACLE MICROS Restaurant Enterprise Series (RES) 3700 POS – a management software suite used by hundreds of thousands of bars, restaurants, hotels and other hospitality establishments worldwide. ModPipe uses modular architecture consisting of basic components and downloadable modules. One of them – named GetMicInfo – contains an algorithm designed to gather database passwords by decrypting them from Windows registry values. Exfiltrated credentials allow ModPipe's operators access to database contents, including various definitions and configuration, status tables and information about POS transactions.

References
2022-06-02 ⋅ Kroll ⋅ Sean Straw
ModPipe POS Malware: New Hooking Targets Extract Card Data
ModPipe
2021-03-23 ⋅ Foregenix ⋅ Mark Shelhart, Niall Newman
ModPipe Malware has a new module that siphons Credit Card Data
ModPipe
2020-11-12 ⋅ ESET Research ⋅ Martin Smolár
Hungry for data, ModPipe backdoor hits POS software used in hospitality sector
ModPipe

There is no Yara-Signature yet.