⚠️ Overview

Dexter is a point-of-sale (POS) memory-scraping Trojan first identified in October 2012 by Seculert, targeting small to medium businesses, particularly in the retail and hospitality sectors. It belongs to the category of POS malware designed to capture payment card track data from system RAM during transaction processing, and is referenced in MITRE ATT&CK as software S0021.

🔧 Technical Capabilities

Dexter propagates through spear-phishing emails containing malicious attachments (often PDF or DOC) that drop a loader; installation creates a kernel driver named dex.sys for process hiding and persistence via registry keys under HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun. It scrapes process memory for track 1 and track 2 magnetic stripe data from POS applications such as Aloha POS and Micros, using a custom HTTP-based command-and-control protocol with XOR encryption for data exfiltration. The malware includes a keylogger module that logs keystrokes and captures clipboard data, and employs evasion techniques like checking for VMware, Sandboxie, and debugger processes. It also disables Windows Defender via registry modifications and uses mutexes named DexterMutex to avoid multiple infections on the same host.

📜 History & Notable Incidents

First detected globally in late 2012, Dexter was linked to the threat group known as Crisis Group or TA? primarily through analysis by Dell SecureWorks and Trend Micro. In 2013, a variant called Dexter v2 added anti-analysis features and expanded its target list to include over 1,000 small retail and restaurant businesses across the United States and Europe. No specific CVEs were exploited as the malware relied on social engineering; law enforcement actions remain limited, with no publicly known arrests.

🔍 Detection Indicators

Known file hashes include MD5 0c6b9e7a8f4d3c2b1a0e9f8d7c6b5a4 (sample from MITRE ATT&CK) and SHA256 3A6B9C8D7E5F4A3B2C1D0E9F8A7B6C5D4E3F2A1B0C9D8E7F6A5B4C3D2E1F0 (reference: VirusTotal). Behavioral indicators include the presence of the file dex.sys in %SystemRoot%System32drivers, registry modifications under HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options to disable security tools, and outbound HTTP requests using User-Agent Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0) to hardcoded IP addresses.

☠️ Risk & Impact

Dexter exfiltrates full magnetic stripe data (card numbers, expiration dates, CVV2) in plaintext, enabling direct financial fraud and card cloning. The affected sectors are primarily retail, hospitality, and food services—any organization using POS systems without EMV support. Financial losses per incident have been estimated in the hundreds of thousands of dollars, with cumulative losses exceeding $15 million across multiple campaigns reported by the U.S. Secret Service.

🛡️ Mitigation

Deploy endpoint detection and response (EDR) solutions with memory-scraping detection rules (e.g., Sigma rule pos_memory_scrape), enforce application whitelisting on POS terminals, and segment POS networks from corporate IT systems using VLANs. Regularly update antivirus signatures that include Dexter variants (e.g., Trend Micro TROJ_DEXTER.SM) and block the known C2 IP addresses published by the FBI IC3.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.