Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Trojan.MWZLesson Point-of-Sale Attack Explained

Name Trojan.MWZLesson
Type PoS Malware, Trojan
Short Description The Trojan is a sophisticated threat that targets PoS terminals.
Distribution Method Through a backdoor or exploiting a vulnerability.
Detection tool Download Malware Removal Tool, to See If Your System Has Been Affected By Trojan.MWZLesson

We have seen multiple Trojans targeting PoS (Point-of-Sale) terminals. Some of them are quite sophisticated and unexpected, while others share similar features and attack tactics. Researchers at Dr Web have recently discovered a new Trojan of the PoS family that is a modification of another, previously known malware. Even though the malware shares characteristics with previous threats, it is still defined as refined and quite severe. The ‘new’ Trojan is dubbed Trojan.MWZLesson. In this article, we are going to describe its attack methods.

p16_0000

Trojan.MWZLesson Attack Description

Once the Trojan is executed, it will modify the registry branch that controls the autorun. Trojan.MWZLesson is also designed to check the RAM of the compromised device for credit and debit card data. All collected information is sent to a Command & Control server. The Trojan is quite similar to another threat of the same kind – Trojan.PWS.Dexter.

Trojan.MWZLesson Malicious Capabilities

It is designed to intercept GET and POST requests sent from the compromised system’s browsers (Mozilla Firefox, Google Chrome, Internet Explorer). The requests are then navigated to the C&C server.

The malicious software is then capable of executing the following commands, as reported by the research team at Dr Web :

  • CMD (cmd.exe). Forward the command to the command interpreter.
  • LOADER. Download and run a file such as dll (using the regsrv tool), vbs (using the wscript tool), and exe (run directly).
  • UPDATE. The threat can update itself.
  • RATE. Set a time interval for communication sessions with the command and control server.
  • FIND. Search and locate documents using a mask.
  • >DDOS. Mount an HTTP Flood attack.

Trojan.MWZLesson C&C Communication

The Trojan interacts with the server via an HTTP protocol. However, the packages initiated by the malware are not encrypted, and packages that don’t have a specified cookie parameter will be ignored by the server.

Trojan.MWZLesson – Related to BackDoor.Neutrino.50

Researchers at Dr Web have referred to the PoS Trojan as a ‘crippled version of the BackDoor.Neutrino.50 version. Its code was used partially. This version of the Neutrino family is described as a multicomponent backdoor that is created to exploit the CVE-2012-0158 vulnerability.

BKDR_KASIDET.FD also known as Backdoor.Neutrino is a Backdoor Trojan that penetrates a system and steals valuable information.

Read More about BKDR_KASIDET.FD

How Can I Protect My Banking Information?

Unfortunately, one can never be sure when and how cyber criminals will initiate an attack against banking systems. What one can do, however, is make sure that his/her computer system and browser are protected against malicious attacks. First, users should improve the security settings of their browsers. Then, a strong anti-malware program should be sustained continuously on the system. Additionally, an external Firewall can also be used, in combination with the Windows firewall.

donload_now_250
Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter

Milena Dimitrova

An inspired writer, focused on user privacy and malicious software. Enjoys 'Mr. Robot' and fears '1984'.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.