TreasureHunter
Description
(FireEye) In this article we examine TREASUREHUNT, POS malware that appears to have been custom-built for the operations of a particular “dump shop,” which sells stolen credit card data. TREASUREHUNT enumerates running processes, extracts payment card information from memory, and then transmits this information to a command and control server.
Names
| Name |
|---|
| TreasureHunter |
| TREASUREHUNT |
| huntpos |
Category
Malware
Type
- POS malware
- Credential stealer
Information
- https://www.fireeye.com/blog/threat-research/2016/03/treasurehunt_a_cust.html
- https://isc.sans.edu/diary/How+Malware+Generates+Mutex+Names+to+Evade+Detection/19429/
- https://www.flashpoint-intel.com/blog/treasurehunter-source-code-leaked/
- http://adelmas.com/blog/treasurehunter.php
- https://blog.group-ib.com/majikpos_treasurehunter_malware
Malpedia
Alienvault Otx
Other Information
Uuid
fe027e13-3f88-49f6-8b42-2f435b61edc0
Last Card Change
2022-11-18