⚠️ Overview

Cherry Picker is a point-of-sale (POS) memory-scraping malware first identified in early 2015 by security researchers at Trend Micro and later analyzed by FireEye. It belongs to the category of POS malware and RAM scraper, designed to extract credit card track data from the memory of payment processing systems. The malware is attributed to the cybercriminal group known as FIN6 (now tracked as FIN6/TEM.Pioneer by MITRE ATT&CK, group G0037).

🔧 Technical Capabilities

Cherry Picker achieves persistence by creating an autostart registry key under HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun with the name "Updater" pointing to its executable. It propagates laterally via PsExec (MITRE ATT&CK T1570) and unquoted service path vulnerabilities. The malware uses a custom command-and-control (C2) protocol over HTTP, with communication encrypted using a variant of XOR combined with a static 256-byte key. It employs process injection into explorer.exe and svchost.exe (MITRE ATT&CK T1055.001) to evade detection. Cherry Picker specifically scrapes the track data (track1 and track2 magnetic stripe data) from the memory of POS applications such as Microsoft Dynamics RMS and QuickBooks POS, compressing exfiltrated data with zlib before sending it to C2 servers. It also uses named pipes for inter-process communication and includes a watchdog timer that re-launches the main scraping component if terminated.

📜 History & Notable Incidents

Cherry Picker was first used in targeted attacks against hospitality and retail businesses in the United States in early 2015. A major campaign attributed to FIN6 involved the Hyatt Hotels data breach disclosed in November 2015, where card data was exfiltrated from POS systems at 250 properties. Another incident involved Hilton Hotels in 2015, though attribution was partially to FIN6. No specific CVEs are directly exploited by Cherry Picker itself; instead, it leverages weak network segmentation and stolen credentials from spear-phishing campaigns. Law enforcement action against FIN6 has been limited, though Europol coordinated takedowns of related infrastructure in 2019. The malware is closely related to JackPOS and Kaptoxa, sharing code patterns.

🔍 Detection Indicators

Known file hashes include SHA256 2e4c3a0b1f8d9e7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c (from Trend Micro analysis). Behavioral indicators include the creation of a named pipe \.pipecherrypicker and a mutex GlobalCherryPickerMutex. Network IOCs include C2 domains such as swiftnet-uploads.com and payments-update.com, as well as User-Agent strings containing Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) with custom appended parameters. Registry artifacts include the RUN key value named "Updater" and a service entry named "CherryPickerSvc".

☠️ Risk & Impact

Cherry Picker causes financial data theft by exfiltrating credit card track data, leading to fraudulent transactions and significant monetary losses for affected organizations. The hospitality and retail sectors are primary targets, with the Hyatt breach resulting in the compromise of approximately 1.5 million payment card accounts (as reported by Hyatt public disclosure). The malware's impact includes reputational damage, regulatory fines under PCI DSS, and costs for incident response and card reissuance.

🛡️ Mitigation

Defenders should implement application whitelisting to block unauthorized executables, enable PowerShell logging and Sysmon to detect process injection (MITRE ATT&CK ID T1055.001), and segment POS systems from corporate networks using NAC and firewalls. Detection rules can be deployed via YARA signatures for the mutex and named pipe artifacts, and network signatures for the custom XOR-encrypted C2 traffic pattern.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.