TrojanSpy.Win32.GRATEFULPOS.A

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It steals certain information from the system and/or the user.

It does not send out the information it steals.

It requires being executed with a specific argument/parameter, an additional component, or in a specific environment in order to proceed with its intended routine.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global.Ms.ThreadPooling.MyAppSingleInstance

Information Theft

This Trojan Spy steals the following information:

• IP Address
• Computer Name
• User Name
• OS Architecture
• Credit Card Information

Drop Points

This Trojan Spy does not send out the information it steals.

Other Details

This Trojan Spy does the following:

• It stores the stolen information in an arbitrary file defined during the attack
• It steals credit card information by scraping for credit card information structure in a process memory
• It requires the following commandline/argument in order for the sample to execute:
  
  rundll32.exe {malware file name}.dll workerInstance {file name to store information}
• It checks if it is currently running with administrative privileges

It requires being executed with a specific argument/parameter, an additional component, or in a specific environment in order to proceed with its intended routine.