New PoS malware “Backoff” targets US - Revision history

Eric.freyssinet: Text replacement - " blog.trendmicro.com" to ""

2015-08-05T20:13:34Z

Text replacement - " blog.trendmicro.com" to ""

← Older revision		Revision as of 20:13, 5 August 2015
Line 4:		Line 4:
	\|Date=2014-08-06		\|Date=2014-08-06
	\|Editor=Trend Micro		\|Editor=Trend Micro
	\|Link=http://blog.trendmicro.com/trendlabs-security-intelligence/new-pos-malware-backoff-targets-us/ ~~blog.trendmicro.com~~		\|Link=http://blog.trendmicro.com/trendlabs-security-intelligence/new-pos-malware-backoff-targets-us/
	\|Abstract=Last week, the US Computer Emergency Readiness Team (US-CERT) reported about a newly discovered malware, dubbed “Backoff”, which targets point-of-sale (PoS) systems. Similar to other PoS malware such as Dexter and Scraper, Backoff is also used to steal financial information for malicious purposes.		\|Abstract=Last week, the US Computer Emergency Readiness Team (US-CERT) reported about a newly discovered malware, dubbed “Backoff”, which targets point-of-sale (PoS) systems. Similar to other PoS malware such as Dexter and Scraper, Backoff is also used to steal financial information for malicious purposes.

Eric.freyssinet at 12:00, 24 May 2015

2015-05-24T12:00:46Z

← Older revision		Revision as of 12:00, 24 May 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|~~Link~~=~~http://blog.trendmicro.com/trendlabs-security-intelligence/new-pos-malware-backoff-targets-us/ blog.trendmicro.com~~		\|Botnet=Backoff, Alina,
	\|~~NomRevue~~=~~Security Intelligence Blog~~		\|Year=2014
	\|Date=2014-08-06		\|Date=2014-08-06
	\|Editor=Trend Micro		\|Editor=Trend Micro
	\|~~Year~~=~~2014~~		\|Link=http://blog.trendmicro.com/trendlabs-security-intelligence/new-pos-malware-backoff-targets-us/ blog.trendmicro.com
	~~\|Botnet=Backoff~~
	\|Abstract=Last week, the US Computer Emergency Readiness Team (US-CERT) reported about a newly discovered malware, dubbed “Backoff”, which targets point-of-sale (PoS) systems. Similar to other PoS malware such as Dexter and Scraper, Backoff is also used to steal financial information for malicious purposes.		\|Abstract=Last week, the US Computer Emergency Readiness Team (US-CERT) reported about a newly discovered malware, dubbed “Backoff”, which targets point-of-sale (PoS) systems. Similar to other PoS malware such as Dexter and Scraper, Backoff is also used to steal financial information for malicious purposes.

	Based on our analysis, when Backoff is executed, it copies itself into %Application Data%\OracleJava\javaw.exe and launches the copy in %Application Data% with parameter -m <path_to_original_backoff>. This will terminate the original Backoff process and delete the initial copy of itself. We have seen the same installation technique used in the Alina family of PoS RAM-scraping malware. More details of its routines can be found in the US-CERT article. This entry, however, focuses on the scope and breadth of its infection.		Based on our analysis, when Backoff is executed, it copies itself into %Application Data%\OracleJava\javaw.exe and launches the copy in %Application Data% with parameter -m <path_to_original_backoff>. This will terminate the original Backoff process and delete the initial copy of itself. We have seen the same installation technique used in the Alina family of PoS RAM-scraping malware. More details of its routines can be found in the US-CERT article. This entry, however, focuses on the scope and breadth of its infection.
			\|NomRevue=Security Intelligence Blog
	}}		}}

Eric.freyssinet: 1 revision imported

2015-02-07T14:30:36Z

1 revision imported

← Older revision		Revision as of 14:30, 7 February 2015
(No difference)

Eric.freyssinet at 08:29, 8 August 2014

2014-08-08T08:29:53Z

New page

{{Publication
|Link=http://blog.trendmicro.com/trendlabs-security-intelligence/new-pos-malware-backoff-targets-us/ blog.trendmicro.com
|NomRevue=Security Intelligence Blog
|Date=2014-08-06
|Editor=Trend Micro
|Year=2014
|Botnet=Backoff
|Abstract=Last week, the US Computer Emergency Readiness Team (US-CERT) reported about a newly discovered malware, dubbed “Backoff”, which targets point-of-sale (PoS) systems. Similar to other PoS malware such as Dexter and Scraper, Backoff is also used to steal financial information for malicious purposes.

Based on our analysis, when Backoff is executed, it copies itself into %Application Data%\OracleJava\javaw.exe and launches the copy in %Application Data% with parameter -m <path_to_original_backoff>. This will terminate the original Backoff process and delete the initial copy of itself. We have seen the same installation technique used in the Alina family of PoS RAM-scraping malware. More details of its routines can be found in the US-CERT article. This entry, however, focuses on the scope and breadth of its infection.
}}