Trojan.MWZLesson Point-of-Sale Attack Explained - How to, Technology and PC Security Forum |

Trojan.MWZLesson Point-of-Sale Attack Explained


with SpyHunter

Scan Your System for Malicious Files
Note! Your computer might be affected by Trojan.MWZLesson and other threats.
Threats such as Trojan.MWZLesson may be persistent on your system. They tend to re-appear if not fully deleted. A malware removal tool like SpyHunter will help you to remove malicious programs, saving you the time and the struggle of tracking down numerous malicious files.
SpyHunter’s scanner is free but the paid version is needed to remove the malware threats. Read SpyHunter’s EULA and Privacy Policy

TypePoS Malware, Trojan
Short DescriptionThe Trojan is a sophisticated threat that targets PoS terminals.
Distribution MethodThrough a backdoor or exploiting a vulnerability.
Detection toolDownload Malware Removal Tool, to See If Your System Has Been Affected By Trojan.MWZLesson

We have seen multiple Trojans targeting PoS (Point-of-Sale) terminals. Some of them are quite sophisticated and unexpected, while others share similar features and attack tactics. Researchers at Dr Web have recently discovered a new Trojan of the PoS family that is a modification of another, previously known malware. Even though the malware shares characteristics with previous threats, it is still defined as refined and quite severe. The ‘new’ Trojan is dubbed Trojan.MWZLesson. In this article, we are going to describe its attack methods.


Trojan.MWZLesson Attack Description

Once the Trojan is executed, it will modify the registry branch that controls the autorun. Trojan.MWZLesson is also designed to check the RAM of the compromised device for credit and debit card data. All collected information is sent to a Command & Control server. The Trojan is quite similar to another threat of the same kind – Trojan.PWS.Dexter.

Trojan.MWZLesson Malicious Capabilities

It is designed to intercept GET and POST requests sent from the compromised system’s browsers (Mozilla Firefox, Google Chrome, Internet Explorer). The requests are then navigated to the C&C server.

The malicious software is then capable of executing the following commands, as reported by the research team at Dr Web :

  • CMD (cmd.exe). Forward the command to the command interpreter.
  • LOADER. Download and run a file such as dll (using the regsrv tool), vbs (using the wscript tool), and exe (run directly).
  • UPDATE. The threat can update itself.
  • RATE. Set a time interval for communication sessions with the command and control server.
  • FIND. Search and locate documents using a mask.
  • >DDOS. Mount an HTTP Flood attack.

Trojan.MWZLesson C&C Communication

The Trojan interacts with the server via an HTTP protocol. However, the packages initiated by the malware are not encrypted, and packages that don’t have a specified cookie parameter will be ignored by the server.

Trojan.MWZLesson – Related to BackDoor.Neutrino.50

Researchers at Dr Web have referred to the PoS Trojan as a ‘crippled version of the BackDoor.Neutrino.50 version. Its code was used partially. This version of the Neutrino family is described as a multicomponent backdoor that is created to exploit the CVE-2012-0158 vulnerability.

BKDR_KASIDET.FD also known as Backdoor.Neutrino is a Backdoor Trojan that penetrates a system and steals valuable information.

Read More about BKDR_KASIDET.FD

How Can I Protect My Banking Information?

Unfortunately, one can never be sure when and how cyber criminals will initiate an attack against banking systems. What one can do, however, is make sure that his/her computer system and browser are protected against malicious attacks. First, users should improve the security settings of their browsers. Then, a strong anti-malware program should be sustained continuously on the system. Additionally, an external Firewall can also be used, in combination with the Windows firewall.

Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter

Milena Dimitrova

An inspired writer and content manager who has been with SensorsTechForum for 4 years. Enjoys ‘Mr. Robot’ and fears ‘1984’. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles!

More Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share