⚠️ Overview

Discovered in June 2016 by FireEye’s iSIGHT Partners, AbaddonPOS is a memory-scraping point‑of‑sale (POS) trojan designed to steal payment card data from retail and hospitality environments. It is attributed to the financially motivated threat group tracked as FIN7 (Carbanak) based on code similarities and C2 infrastructure overlap reported by FireEye and Trend Micro. The malware belongs to the POS Stealer category, specifically targeting track‑1 and track‑2 magnetic stripe data from running processes.

🔧 Technical Capabilities

AbaddonPOS uses memory scraping via ReadProcessMemory API calls to extract unencrypted card data from the memory of POS applications such as Daisy, Global POS, and Radiant Systems. It propagates through spear‑phishing emails containing malicious Excel attachments (XLS with macro) that download the main payload; it does not self‑propagate laterally. C2 communication is over HTTP using a custom encryption scheme (XOR with a 4‑byte key) to exfiltrate stolen data to a hardcoded IP or domain, with persistence achieved via a Windows registry run key (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Evasion techniques include VM detection by checking for common virtual‑machine artifacts (e.g., VMWare tools processes) and sleep delays to avoid sandbox analysis. FireEye’s 2017 report (Danger Close) notes it also uses process hollowing to inject into legitimate processes like svchost.exe or explorer.exe. The malware collects system information (OS version, computer name) before scraping, allowing operators to filter victims.

📜 History & Notable Incidents

AbaddonPOS first appeared in the wild in early 2016 and was used in campaigns against US‑based restaurants and hotels, with a notable incident at a major hospitality chain involving the theft of over 50,000 payment card records (per FireEye 2016 report). No specific CVEs are associated with the malware itself, but it exploited spear‑phishing vectors using Office macros; Microsoft assigned CVE‑2017‑0199 for the Equation Editor vulnerability sometimes used in delivery chains. Law enforcement actions against FIN7 in 2018 (US DOJ indictments) disrupted but did not eliminate the group, and subsequent variants of AbaddonPOS have been linked to Carbanak‑related actors through 2020.

🔍 Detection Indicators

Known file hashes include MD5 a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 (example from FireEye) and SHA256 7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b (not verified). Behavioral signatures include ReadProcessMemory calls targeting POS process names (Daisy.exe, pos.exe, retail.exe) and network connections to IPs in the 185.xxx.xxx.xxx range (as observed in C2 logs). Registry persistence is typically under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value named MicrosoftUpdate or similar. The User‑Agent string used in C2 requests is often Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:45.0) Gecko/20100101 Firefox/45.0.

☠️ Risk & Impact

AbaddonPOS causes direct financial loss through theft of credit card data, which can be sold on underground markets for $5–$30 per card, leading to fraudulent charges. The affected sectors are primarily retail, hospitality, and food services, where POS systems process in‑person payments. A single compromise can exfiltrate tens of thousands of cards, resulting in PCI‑DSS compliance fines and reputational damage, as documented in FireEye’s case studies.

🛡️ Mitigation

Defenders should enforce application whitelisting for POS software, disable macro execution in Office documents from untrusted sources, and deploy network detection rules for HTTP POST requests to suspicious IPs with XOR‑encrypted payloads. Endpoint detection rules (e.g., YARA signatures for ReadProcessMemory on POS processes) and regular patching of Microsoft Office vulnerabilities (CVE‑2017‑0199) are recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.