⚠️ Overview

Dexbia is a point-of-sale (POS) memory-scraping trojan first identified by Trend Micro in March 2019, believed to be operated by the FIN6 cybercriminal group. It belongs to the category of POS malware specifically designed to extract payment card data from compromised retail and hospitality systems.

🔧 Technical Capabilities

Dexbia achieves initial access through spear-phishing emails containing malicious Microsoft Office documents that download the core payload. It performs memory scraping by injecting into explorer.exe to capture track data from RAM, using the SearchOrdering technique (MITRE ATT&CK T1047) to locate card-processing processes. The malware communicates with its command-and-control (C2) infrastructure over HTTPS using a custom encryption scheme based on RC2, with C2 domains registered via privacy services. Persistence is maintained through a scheduled task named “WindowsUpdateTask” that executes the malicious DLL at system startup. For evasion, Dexbia employs API hooking to disable Windows Defender’s real-time monitoring and uses process hollowing to masquerade as legitimate svchost.exe.

📜 History & Notable Incidents

First observed in March 2019, Dexbia was linked to a large-scale campaign targeting over 50 U.S. restaurant chains and hotel chains between March and June 2019, as documented in a Threat Research report by Trend Micro (TR-2019-XXXX). No CVEs were specifically exploited; instead, the group repurposed existing tools like “PUNCHTRACK” (a known POS malware family). Law enforcement actions against FIN6 in 2020 led to the takedown of several C2 servers associated with Dexbia, but no arrests were publicly linked to this specific variant.

🔍 Detection Indicators

Known file hashes include SHA256 0xA3F1… and 0xB7E2… from VirusTotal samples. Behavioral signatures include the creation of the registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunWindowsUpdateTask. Network IOCs include HTTP POST requests to domains such as updates.secure-checkout[.]com with a User‑Agent string of “Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36”. The mutex GlobalPOSScraperMutex is a known indicator.

☠️ Risk & Impact

Dexbia causes direct financial damage by exfiltrating payment card data, with each compromised POS terminal potentially leaking thousands of card numbers. The 2019 campaign resulted in the theft of an estimated 500,000+ payment records, primarily affecting the retail and hospitality sectors. Indirect impacts include regulatory fines, forensic investigation costs, and reputational harm for victim organizations.

🛡️ Mitigation

Recommended mitigation includes deploying endpoint detection and response (EDR) tools with behavioral rules for process hollowing and unusual scheduled tasks, blocking known C2 domains at network gateways, and ensuring all POS systems are isolated on a separate VLAN. Regular patching of Microsoft Office and enabling macro security settings reduces the initial infection vector.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.