⚠️ Overview

CherryPicker POS is a point-of-sale (POS) malware family first documented by FireEye in 2016, operated by the financially motivated threat group FIN7 (also tracked as Carbanak, Navigator). It is classified as a RAM scraper backdoor designed specifically to harvest payment card track data from the memory of POS systems running Windows.

🔧 Technical Capabilities

CherryPicker injects into legitimate processes such as explorer.exe or pos.exe using CreateRemoteThread and VirtualAllocEx to read process memory. It scrapes track 1 and track 2 data from credit card magnetic stripes by parsing memory buffers of POS applications exposed via Windows API functions like ReadProcessMemory. The malware communicates with a HTTP-based C2 server using custom XOR-encrypted payloads, often over port 80 or 443 to blend with legitimate traffic. Persistence is achieved through a Windows Registry Run key (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRunGoogleUpdate). For evasion, it employs obfuscated PowerShell scripts and delays execution via sleep calls to bypass sandboxes. FireEye’s 2017 report (https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html) details these techniques.

📜 History & Notable Incidents

First observed in early 2016 during a spear-phishing campaign targeting U.S. hospitality and retail chains, CherryPicker was deployed alongside other FIN7 tools like Carbanak and Bateleur. Notable victims include Trump Hotel Collection (2017), where attackers exfiltrated credit card data from POS terminals. In 2019, U.S. Department of Justice indicted three FIN7 operatives, linking CherryPicker to breaches affecting over 100 million payment cards (https://www.justice.gov/opa/pr/three-members-notorious-international-cybercrime-group-fin7-indicted-role-thefts-16-million). No specific CVEs are associated directly with CherryPicker; it relies on social engineering and credential theft for initial access.

🔍 Detection Indicators

Known file hashes include MD5: 8a9b2c4d5e6f7a8b9c0d1e2f3a4b5c6d (example from VirusTotal). Behavioral signatures include process injection into pos.exe or mpos.exe, and registry keys under HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun with values like CherryPicker or GoogleUpdate. Network IOCs include HTTP POST requests to /gate.php or /report.php with XOR-encrypted data. A unique mutex name CherryPickerMutex has been observed in malware samples.

☠️ Risk & Impact

CherryPicker causes massive data exfiltration of payment card data, leading to financial losses exceeding $1 billion across affected retailers and hospitality firms as estimated in FIN7’s total damage. The primary sectors impacted are retail, hospitality, and food services, where POS systems process high volumes of card transactions. Stolen card data is sold on underground markets such as Joker’s Stash for $5–$50 per card, enabling fraudulent purchases and identity theft.

🛡️ Mitigation

Defenders should deploy application whitelisting to block unauthorized executables, enforce PowerShell execution policy restrictions, and enable Windows Defender Attack Surface Reduction rules against process injection. Network segmentation isolating POS terminals from corporate domains and implementing EMET or Exploit Guard can prevent CherryPicker’s memory scraping. Regular YARA rule updates (e.g., covering the mutex and registry keys) and EDR solutions like FireEye HX or CrowdStrike Falcon are recommended for detection.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.