Róbert Neumann - What's 4k in real Money?

### Overview Róbert Neumann, a security researcher on the Special Investigation Team at Forcepoint, presents an investigation into a widespread point-of-sale (POS) malware campaign characterized by extremely small (~4 kilobyte) assembly-based binaries. The investigation began following Forcepoint's discovery of Udpos (which used DNS data exfiltration) and public reports on PinkKite malware (a 4–6 KB POS malware utilizing double-XOR encryption and clearing houses), both evoking older malware families like TinyPOS and AbaddonPOS. While researchers initially anticipated only a handful of samples, the team collected over 1,500 unique samples, discovering that the overwhelming majority acted as modular downloaders while fewer than 40 were actual final payloads.

### Key Topics - **Staged Infiltration Architecture**: The attack relies on modular components: initial tiny loaders/downloaders, multi-stage fragmented shellcode, reconnaissance tools (Scouts), and memory scrapers. - **Obfuscation and Anti-Analysis**: Attackers utilize custom code-push obfuscation, fake API calls, junk instructions, randomized version info, XOR decryption wrappers, and basic execution-skipping techniques rather than heavy anti-debug or anti-sandbox mechanisms. - **POS Reconnaissance**: Profiling victim environments using targeted Scout tools comparing processes against an extensive list of over 300 POS software names. - **POS Ecosystem Vulnerabilities**: Legacy hardware and operating systems (Windows XP-based POSReady 2009 and Windows 7-based POSReady 7), weak remote access configurations, and unencrypted magnetic stripe Track 1 and Track 2 data in memory.

### Technical Details - **Downloaders (Tiny Loaders)**: Averaging ~4 KB, these samples decrypt themselves using a fast DWORD brute-force XOR routine at the entry point without storing the decryption key. They connect to C2 servers using dual IP address configurations (often duplicating constants due to developer laziness) and frequently cycling port numbers (incrementing by 1 or 2 per campaign). The downloader fetches fragmented shellcode in chunks of a few hundred bytes, which reassembles in memory. - **Shellcode Execution & Profiling**: Once staged, shellcode resolves API names dynamically and performs process filtering using truncated 4-character process strings. It collects running process lists and relays them to C2 infrastructure. If the victim is non-viable, it executes progressive sleep loops (minutes to hours) rather than terminating immediately. - **Scout Modules (Type A & Type B)**: Type A maps running processes, attempting to open each and logging success (`OK`) or failure flags (`EOF`). Type B gathers the PC name, maps the local network (`net view`), and cross-references running processes against a static list of 327 distinct POS application names matching only the first 6 characters. - **POS Memory Scraper Module**: The final payload operates without binary-level encryption because targeted POS endpoints rarely run security software. It conducts multi-threaded memory scraping to locate and extract Track 1 and Track 2 magnetic stripe card data. The extracted track data is XOR-encrypted prior to C2 exfiltration to bypass DLP systems. Code evolution shows updates between January and September to refine memory read buffer sizes (down from ~400 KB chunks) and increase sleep intervals to avoid read exceptions.

### Takeaways - Attackers do not need complex, bloated codebases; a ~4 KB assembly-written binary is lightweight, highly modular, fast to recompile or modify, and avoids runtime dependencies. - The pre-compiled database of 327 distinct POS process signatures demonstrates multi-year development and persistent targeting across commercial POS vendors. - POS exploitation remains prevalent due to legacy OS platforms reaching end-of-life, delayed EMV/chip adoption compared to magnetic swipe transactions, unencrypted memory architectures, and compromised remote administration tools.