SYMBOLCOMMON_NAMEaka. SYNONYMS
win.pillowmint (Back to overview)

PILLOWMINT

Actor(s): Anunak


According to FireEye, PILLOWMINT is a Point-of-Sale malware tool used to scrape track 1 and track 2 payment card data from memory.
Scraped payment card data is encrypted and stored in the registry and as plaintext in a file (T1074: Data Staged)
Contains additional backdoor capabilities including:
Running processes
Downloading and executing files (T1105: Remote File Copy)
Downloading and injecting DLLs (T1055: Process Injection)
Communicates with a command and control (C2) server over HTTP using AES encrypted messages
(T1071: Standard Application Layer Protocol)
(T1032: Standard Cryptographic Protocol)

References
2021-08-30CrowdStrikeEric Loui, Josh Reynolds
@online{loui:20210830:carbon:66be3f3, author = {Eric Loui and Josh Reynolds}, title = {{CARBON SPIDER Embraces Big Game Hunting, Part 1}}, date = {2021-08-30}, organization = {CrowdStrike}, url = {https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/}, language = {English}, urldate = {2021-08-31} } CARBON SPIDER Embraces Big Game Hunting, Part 1
Bateleur Griffon Carbanak DarkSide JSSLoader PILLOWMINT REvil
2020-06-22TrustwaveRodel Mendrez
@online{mendrez:20200622:pillowmint:c696f56, author = {Rodel Mendrez}, title = {{Pillowmint: FIN7’s Monkey Thief}}, date = {2020-06-22}, organization = {Trustwave}, url = {https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/}, language = {English}, urldate = {2020-06-24} } Pillowmint: FIN7’s Monkey Thief
PILLOWMINT
2018-10-01FireEyeRegina Elwell, Katie Nickels
@techreport{elwell:20181001:attcking:3c6d888, author = {Regina Elwell and Katie Nickels}, title = {{ATT&CKing FIN7}}, date = {2018-10-01}, institution = {FireEye}, url = {https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf}, language = {English}, urldate = {2020-06-25} } ATT&CKing FIN7
Bateleur BELLHOP Griffon ANTAK POWERPIPE POWERSOURCE HALFBAKED BABYMETAL Carbanak Cobalt Strike DNSMessenger DRIFTPIN PILLOWMINT SocksBot
Yara Rules
[TLP:WHITE] win_pillowmint_auto (20221125 | Detects win.pillowmint.)
rule win_pillowmint_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-11-21"
        version = "1"
        description = "Detects win.pillowmint."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pillowmint"
        malpedia_rule_date = "20221118"
        malpedia_hash = "e0702e2e6d1d00da65c8a29a4ebacd0a4c59e1af"
        malpedia_version = "20221125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8ac2 c0e202 02c2 02c0 2ac8 b81f85eb51 02cb }
            // n = 7, score = 100
            //   8ac2                 | je                  0xd99
            //   c0e202               | dec                 eax
            //   02c2                 | mov                 ecx, dword ptr [ebx + 0x80]
            //   02c0                 | dec                 esp
            //   2ac8                 | mov                 eax, dword ptr [ebx + 0x68]
            //   b81f85eb51           | dec                 eax
            //   02cb                 | dec                 ecx

        $sequence_1 = { 483bca 7413 4983c9ff 4533c0 488d8da0000000 e8???????? }
            // n = 6, score = 100
            //   483bca               | cmp                 ecx, 1
            //   7413                 | jge                 0x1928
            //   4983c9ff             | mov                 ecx, 0xa
            //   4533c0               | jmp                 0x1949
            //   488d8da0000000       | mov                 ecx, dword ptr [edi]
            //   e8????????           |                     

        $sequence_2 = { 80781900 74e9 493bd8 741e 8b4320 3902 7217 }
            // n = 7, score = 100
            //   80781900             | inc                 ebp
            //   74e9                 | xor                 ecx, ecx
            //   493bd8               | inc                 ebp
            //   741e                 | xor                 eax, eax
            //   8b4320               | mov                 edx, 0x40000000
            //   3902                 | mov                 dword ptr [esp + 0x28], 0
            //   7217                 | mov                 dword ptr [esp + 0x20], 4

        $sequence_3 = { ff15???????? 33c0 488b8c2450210000 4833cc e8???????? 4881c470210000 415e }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   33c0                 | lea                 eax, [ebp + 0x30]
            //   488b8c2450210000     | dec                 eax
            //   4833cc               | mov                 edx, eax
            //   e8????????           |                     
            //   4881c470210000       | dec                 esp
            //   415e                 | lea                 eax, [0x36ffa]

        $sequence_4 = { 0f43c2 8805???????? 483b0d???????? 7711 488d55a8 488d0d2cab0300 e8???????? }
            // n = 7, score = 100
            //   0f43c2               | mov                 edx, eax
            //   8805????????         |                     
            //   483b0d????????       |                     
            //   7711                 | dec                 eax
            //   488d55a8             | lea                 ecx, [ebp - 0x28]
            //   488d0d2cab0300       | nop                 
            //   e8????????           |                     

        $sequence_5 = { 4c89b590000000 4488b580000000 458d460d 488d15a9940200 488d8d80000000 e8???????? 90 }
            // n = 7, score = 100
            //   4c89b590000000       | mov                 dword ptr [ebp - 0x51], ebx
            //   4488b580000000       | mov                 byte ptr [ebp - 0x61], 0
            //   458d460d             | dec                 eax
            //   488d15a9940200       | cmp                 dword ptr [ebp - 0x69], 0x10
            //   488d8d80000000       | jb                  0xa95
            //   e8????????           |                     
            //   90                   | dec                 eax

        $sequence_6 = { 4533f6 488d5f28 90 48833b10 7209 488b4be8 }
            // n = 6, score = 100
            //   4533f6               | mov                 edx, edi
            //   488d5f28             | or                  edx, 4
            //   90                   | jmp                 0x602
            //   48833b10             | mov                 edx, edi
            //   7209                 | dec                 eax
            //   488b4be8             | cmp                 dword ptr [ecx + 0x48], edx

        $sequence_7 = { 488bc4 55 4156 4157 488da808ffffff 4881ece0010000 48c7442460feffffff }
            // n = 7, score = 100
            //   488bc4               | dec                 eax
            //   55                   | lea                 ecx, [ebp + 8]
            //   4156                 | xor                 ecx, ecx
            //   4157                 | dec                 eax
            //   488da808ffffff       | mov                 edx, eax
            //   4881ece0010000       | inc                 ecx
            //   48c7442460feffffff     | mov    eax, 8

        $sequence_8 = { 4883bdb800000010 720c 488b8da0000000 e8???????? 4c89bdb8000000 48899db0000000 c685a000000000 }
            // n = 7, score = 100
            //   4883bdb800000010     | mov                 eax, 8
            //   720c                 | dec                 eax
            //   488b8da0000000       | mov                 ecx, ebx
            //   e8????????           |                     
            //   4c89bdb8000000       | test                eax, eax
            //   48899db0000000       | jmp                 0x137a
            //   c685a000000000       | dec                 eax

        $sequence_9 = { 488b88f0000000 488b01 8a08 880a 33c9 488d1c32 4c8d05735d0100 }
            // n = 7, score = 100
            //   488b88f0000000       | inc                 ecx
            //   488b01               | lea                 esi, [edi + 1]
            //   8a08                 | jl                  0xc49
            //   880a                 | dec                 eax
            //   33c9                 | mov                 dword ptr [ebp + 0x68], 0xf
            //   488d1c32             | dec                 esp
            //   4c8d05735d0100       | mov                 dword ptr [ebp + 0x60], edi

    condition:
        7 of them and filesize < 4667392
}
Download all Yara Rules