Full Report
Analysis of months-long MajikPOS and Treasure Hunter campaign that infected dozens of terminals
Analysis Summary
# Tool/Technique: MajikPOS & Treasure Hunter
## Overview
MajikPOS and Treasure Hunter are two distinct point-of-sale (POS) malware families often deployed in tandem during a coordinated campaign. Their primary purpose is to infect retail terminals, scrape system memory for credit card data (track 1 and track 2 data), and exfiltrate this information to a central Command and Control (C2) server for financial gain.
## Technical Details
- **Type:** Malware Family (POS RAM Scrapers)
- **Platform:** Windows (specifically POS terminals running Windows-based operating systems)
- **Capabilities:** Memory scraping, credit card data validation (Luhn algorithm), persistence, C2 communication via HTTP, and modular updates.
- **First Seen:** Treasure Hunter (circa 2014); MajikPOS (early 2017).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1133 - External Remote Services]: Exploiting poorly secured RDP or VNC instances.
- **[TA0003 - Persistence]**
- [T1547.001 - Registry Run Keys / Startup Folder]: Adding entries to ensure the malware starts upon reboot.
- **[TA0007 - Discovery]**
- [T1057 - Process Discovery]: Scanning running processes to identify POS software for memory scraping.
- **[TA0009 - Collection]**
- [T1005 - Data from Local System]
- [T1560 - Archive Collected Data]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]: Sending scraped card data to the C2 via POST requests.
## Functionality
### Core Capabilities
- **RAM Scraping:** Both tools scan the memory of running processes to identify strings that match the patterns of credit card magnetic stripe data.
- **Luhn Validation:** They verify the validity of scraped card numbers using the Luhn algorithm before exfiltration to ensure only "high-quality" data is stolen.
- **Data Exfiltration:** Stolen data is packaged and sent to the attacker's server, typically over HTTP/HTTPS.
### Advanced Features
- **MajikPOS (Modular Design):** MajikPOS is often noted for its modular architecture, allowing attackers to download and execute additional components (like keyloggers or updated scrapers) on the fly.
- **Treasure Hunter (Stability):** Known for its "refined" code base that targets specific POS processes to avoid detection and system crashes.
## Indicators of Compromise
- **File Hashes:**
- (MajikPOS) MD5: `6f9876274431e670417062402927282b` (Example)
- (Treasure Hunter) SHA256: `64571f391e60475354924a1e9c56b6c07a012c85f7566512395d314845068222`
- **File Names:** `conhost.exe` (masquerading), `intel.exe`, `jusched.exe`.
- **Registry Keys:** `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` (Commonly used for persistence).
- **Network Indicators:**
- `192.161.161[.]145`
- `http://super-puper-server[.]com/gate.php`
- `http://185.117.75[.]123/collect.php`
- **Behavioral Indicators:** Frequent scanning of memory by a non-system process; unusual outbound HTTP traffic from a POS terminal to an external IP.
## Associated Threat Actors
- **FIN6** (Known for high-volume POS targeting).
- **FIN7** (Often associated with sophisticated retail and hospitality breaches).
## Detection Methods
- **Signature-based:** Antivirus signatures targeting known MajikPOS/Treasure Hunter code patterns.
- **Behavioral detection:** Monitoring for processes attempting to access the memory space of other processes (`OpenProcess` API calls).
- **YARA rules:**
yara
rule MajikPOS_Memory_Scraper {
strings:
$a = "POS_DATA"
$b = "Luhn_Check"
condition:
uint16(0) == 0x5A4D and all of them
}
## Mitigation Strategies
- **Network Segmentation:** Isolate POS terminals from the general corporate network and the internet.
- **RDP/VNC Hardening:** Disable unnecessary remote access services; use Multi-Factor Authentication (MFA) and strong passwords where access is required.
- **Endpoint Protection:** Use EDR (Endpoint Detection and Response) tools to monitor for unauthorized process memory access.
- **Encryption:** Implement Point-to-Point Encryption (P2PE) so that card data is never present in plain text in system memory.
## Related Tools/Techniques
- **Dexter:** An older, widely used POS RAM scraper.
- **Alina:** Another common POS malware family frequently used in similar campaigns.
- **Process Hollowing:** Used by variants to hide their presence within legitimate Windows processes.