Difference between revisions of "TreasureHunt: a custom POS malware tool"
Jump to navigation
Jump to search
(Created page with "{{Publication| Link=https://www.fireeye.com/blog/threat-research/2016/03/treasurehunt_a_cust.html}}") |
|||
| Line 1: | Line 1: | ||
{{Publication| Link=https://www.fireeye.com/blog/threat-research/2016/03/treasurehunt_a_cust.html}} | {{Publication | ||
|Editor=FireEye | |||
|Link=https://www.fireeye.com/blog/threat-research/2016/03/treasurehunt_a_cust.html | |||
|Author=Nart Villeneuve, | |||
|Type=Blogpost | |||
|Abstract=In this article we examine TREASUREHUNT, POS malware that appears to have been custom-built for the operations of a particular “dump shop,” which sells stolen credit card data. TREASUREHUNT enumerates running processes, extracts payment card information from memory, and then transmits this information to a command and control server. | |||
}} | |||
Revision as of 17:22, 28 March 2016
(Publication) Google search: [1]
| TreasureHunt: a custom POS malware tool | |
|---|---|
| Botnet | |
| Malware | |
| Botnet/malware group | |
| Exploit kits | |
| Services | |
| Feature | |
| Distribution vector | |
| Target | |
| Origin | |
| Campaign | |
| Operation/Working group | |
| Vulnerability | |
| CCProtocol | |
| Date | / |
| Editor/Conference | FireEye |
| Link | https://www.fireeye.com/blog/threat-research/2016/03/treasurehunt a cust.html (Archive copy) |
| Author | Nart Villeneuve |
| Type | Blogpost |
Abstract
“ In this article we examine TREASUREHUNT, POS malware that appears to have been custom-built for the operations of a particular “dump shop,” which sells stolen credit card data. TREASUREHUNT enumerates running processes, extracts payment card information from memory, and then transmits this information to a command and control server.
Bibtex
@misc{Lua error: Cannot create process: proc_open(/dev/null): failed to open stream: Operation not permittedBFR4917,
editor = {FireEye},
author = {Nart Villeneuve},
title = {TreasureHunt: a custom POS malware tool},
date = {05},
month = May,
year = {},
howpublished = {\url{https://www.fireeye.com/blog/threat-research/2016/03/treasurehunt_a_cust.html}},
}