|Type||PoS Malware, Trojan|
|Short Description||The Trojan is a sophisticated threat that targets PoS terminals.|
|Distribution Method||Through a backdoor or exploiting a vulnerability.|
|Detection tool||Download Malware Removal Tool, to See If Your System Has Been Affected By Trojan.MWZLesson|
We have seen multiple Trojans targeting PoS (Point-of-Sale) terminals. Some of them are quite sophisticated and unexpected, while others share similar features and attack tactics. Researchers at Dr Web have recently discovered a new Trojan of the PoS family that is a modification of another, previously known malware. Even though the malware shares characteristics with previous threats, it is still defined as refined and quite severe. The ‘new’ Trojan is dubbed Trojan.MWZLesson. In this article, we are going to describe its attack methods.
Trojan.MWZLesson Attack Description
Once the Trojan is executed, it will modify the registry branch that controls the autorun. Trojan.MWZLesson is also designed to check the RAM of the compromised device for credit and debit card data. All collected information is sent to a Command & Control server. The Trojan is quite similar to another threat of the same kind – Trojan.PWS.Dexter.
Trojan.MWZLesson Malicious Capabilities
It is designed to intercept GET and POST requests sent from the compromised system’s browsers (Mozilla Firefox, Google Chrome, Internet Explorer). The requests are then navigated to the C&C server.
The malicious software is then capable of executing the following commands, as reported by the research team at Dr Web :
- CMD (cmd.exe). Forward the command to the command interpreter.
- LOADER. Download and run a file such as dll (using the regsrv tool), vbs (using the wscript tool), and exe (run directly).
- UPDATE. The threat can update itself.
- RATE. Set a time interval for communication sessions with the command and control server.
- FIND. Search and locate documents using a mask.
- >DDOS. Mount an HTTP Flood attack.
Trojan.MWZLesson C&C Communication
The Trojan interacts with the server via an HTTP protocol. However, the packages initiated by the malware are not encrypted, and packages that don’t have a specified cookie parameter will be ignored by the server.
Trojan.MWZLesson – Related to BackDoor.Neutrino.50
Researchers at Dr Web have referred to the PoS Trojan as a ‘crippled version of the BackDoor.Neutrino.50 version. Its code was used partially. This version of the Neutrino family is described as a multicomponent backdoor that is created to exploit the CVE-2012-0158 vulnerability.
BKDR_KASIDET.FD also known as Backdoor.Neutrino is a Backdoor Trojan that penetrates a system and steals valuable information.
Read More about BKDR_KASIDET.FD
How Can I Protect My Banking Information?
Unfortunately, one can never be sure when and how cyber criminals will initiate an attack against banking systems. What one can do, however, is make sure that his/her computer system and browser are protected against malicious attacks. First, users should improve the security settings of their browsers. Then, a strong anti-malware program should be sustained continuously on the system. Additionally, an external Firewall can also be used, in combination with the Windows firewall.
Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter