Dear Threat Actor(s) targeting POS systems, After @malwrhunterteam saw your malware payloads being distributed online, presumably trying to infect restaurants like Buffalo Wild Wings, I can see you've switched up your tactics a little. Your latest payload, which is delivered from a different web domain, is absolutely cooked. You forgot to strip the metadata out of your payload. I was able to immediately recover everything and quite literally get your payload back to damn near the original source code. I can see how you're: - Keylogging - Managing these computers remotely with Hidden VNC - Registering infected machines with your C2 - Attempting to evade security products - Pulling credit-card numbers out of POS systems when customers swipe their credit card - Attempting to move laterally over the network by exploiting SMB - etc It would be unethical of me to give you advice on how to write malware, but I really want to emphasize that I know you're using AI to write this malware and that you're making really goofy mistakes. Your domain "test(.)qovexira(.)xyz" is in plain text and is directly under the function "register_with_c2". Code metadata you left in place: - auto_ops_thread - beacon_loop - check_for_update - dbglog - delayed_persistence_thread - detect_pos_role - exec_command - format_card_tracks - generate_agent_id - get_system_info - http_get - http_post - hvnc_input_thread - hvnc_spawn_app - hvnc_stream_thread - hvnc_task - implant_upload_file - install_persistence - is_btc_address - is_eth_address - kb_buf_read (Keyboard) - kb_hook_routine (Keyboard) - kb_hook_start (Keyboard) - lan_collect_neighbors - lanmon_capture - lanspread_smb_push - peak_hours_thread - pos_aloha_info_run - pos_db_dump_run - pos_ensure_drop_dir - pos_lsa_dump_run - pos_mod_op_7 - pos_module_run - pos_port_sweep_run - pos_ram_scrape_run - pos_terminal_run - pos_upload_file - process_task - read_file - register_with_c2 - run_ch - run_pivot_scan - scanner_watch_thread - self_heal_persistence - send_result - steal_browser_creds - take_screenshot - update_loop - upq_worker - watchdog_thread - write_file

Dear Red Team nerds, If you're curious what a successful and serious malware campaign looks like (if you want to make a more serious Red Team engagement) I HIGHLY suggest reading the write up on the new malware campaign called TransferLoader zscaler.com/blogs/security-r…