Alina malware

Alina is a Point of Sale Malware or POS RAM Scraper that is used by cybercriminals to scrape credit card and debit card information from the point of sale system.^[1] It first started to scrape information in late 2012. It resembles JackPOS Malware.^[2][3]

Process of Alina POS RAM Scraper

Once executed, it gets installed on the user computer and check for the alina code update. Then it removes the existing alina code and installs the latest version of code. Next, it adds the file path to an Auto Start runkey to remain persistent. Adds java.exe to the %APPDATA% directory and executes the copy in %APPDATA% directory using the parameter called alina= <original_alina> as a final step of installation.^[4][5]

It inspects the process of the user with the help of CreateToolhelp32Snapshot and takes the snapshot of all the processes. The Process32First which retrieves the track 1 and track 2 information in the process memory. Alina maintains the blacklist of processes, if there is no process information in the blacklist it opens OpenProcess and read the memory content to run the process memory content. Once the data are scraped it sends it to C&C serves using HTTP POST that are hardcoded in binary.^[6]

See also

• Point-of-sale malware
• Cyber security standards
• List of cyber attack threat trends

References

1. Alina POS malware "sparks" off a new variant
2. New Variant of Alina PoS Malware
3. Alina POS Malware
4. PoS RAM Scraper Malware: Past, Present, and Future
5. PoS RAM Scraper Malware Mechanism
6. Alina: Casting a Shadow on POS