Alina (malware)

Short description: Point of Sale Malware

Alina is a Point of Sale Malware or POS RAM Scraper that is used by cybercriminals to scrape credit card and debit card information from the point of sale system.^[1] It first started to scrape information in late 2012. It resembles JackPOS Malware.^[2]^[3]

Process of Alina POS RAM Scraper

Once executed, it gets installed on the user's computer and checks for updates. If an update is found, it removes the existing Alina code and installs the latest version. Then, for new installations, it adds the file path to an AutoStart runkey to maintain persistence. Finally, it adds java.exe to the %APPDATA% directory and executes it using the parameter alina=<path_to_executable> for new installations or, update=<orig_exe>;<new_exe> for upgrades.^[4]^[5]^[6]

Alina inspects the user's processes with the help of Windows API calls:

CreateToolhelp32Snapshot() takes a snapshot of all running processes
Process32First()/Process32Next() retrieve the track 1 and track 2 information in the process memory

Alina maintains a blacklist of processes, if there is no process information in the blacklist it uses OpenProcess() to read and process the contents in the memory dump. Once the data is scraped Alina sends it to C&C servers using an HTTP POST command that is hardcoded in binary.^[6]

References

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Alina (malware). Read more

[1] "Alina POS malware "sparks" off a new variant". https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/alina-pos-malware-sparks-off-a-new-variant/.

[2] "Researchers ID New Variant of Alina PoS Malware | SecurityWeek.Com". 18 December 2014. https://www.securityweek.com/researchers-id-new-variant-alina-pos-malware.

[3] Alina POS Malware

[4] "PoS RAM Scraper Malware: Past, Present, and Future". http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-pos-ram-scraper-malware.pdf.

[5] "PoS RAM Scraper Malware Mechanism". http://blog.sisainfosec.com/2015/07/pos-malware-stealth-tool-to-steal.html.

[:0-6] 6.0 ^6.1 "Alina: Casting a Shadow on POS". https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/alina-casting-a-shadow-on-pos/.

[1]

[2]

[3]

[4]

[5]

[6]

v t e Malware topics
Infectious malware	Comparison of computer viruses Computer virus Computer worm List of computer worms Timeline of computer viruses and worms
Concealment	Backdoor Clickjacking Man-in-the-browser Man-in-the-middle Man-in-the-mobile Rootkit Trojan horse Zombie computer
Malware for profit	Adware Botnet Crimeware Form grabbing Fraudulent dialer Malbot Keystroke logging Privacy-invasive software Ransomware Rogue security software Scareware Spyware Web threats
By operating system	Android malware Classic Mac OS viruses iOS malware Linux malware MacOS malware Macro virus Mobile malware Palm OS viruses
Protection	Anti-keylogger Antivirus software Browser security Data loss prevention software Defensive computing Firewall Internet security Intrusion detection system Mobile security Network security
Countermeasures	Computer and network surveillance Honeypot Bot Roast

Alina (malware)

Process of Alina POS RAM Scraper

See also

References