type: malware
spec_version: 2.1
id: malware--9752aef4-a1f3-4328-929f-b64eb0536090
created: 2018-01-16T16:13:52.465Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0169
external_id: S0169
source_name: RawPOS
description: (Citation: Kroll RawPOS Jan 2017) (Citation: TrendMicro RawPOS April 2015) (Citation: DarkReading FireEye FIN5 Oct 2015)
source_name: FIENDCRY
description: The FIENDCRY component is a memory scraper based on MemPDump that scans through process memory looking for regular expressions. Its stage 1 component scans all processes, and its stage 2 component targets a specific process of interest. (Citation: Mandiant FIN5 GrrCON Oct 2016) (Citation: Github Mempdump) (Citation: DarkReading FireEye FIN5 Oct 2015)
source_name: DUEBREW
description: The DUEBREW component is a Perl2Exe binary launcher. (Citation: Mandiant FIN5 GrrCON Oct 2016) (Citation: DarkReading FireEye FIN5 Oct 2015)
source_name: DRIFTWOOD
description: The DRIFTWOOD component is a Perl2Exe compiled Perl script used by G0053 after they have identified data of interest on victims. (Citation: Mandiant FIN5 GrrCON Oct 2016) (Citation: DarkReading FireEye FIN5 Oct 2015)
source_name: Kroll RawPOS Jan 2017
description: Nesbit, B. and Ackerman, D. (2017, January). Malware Analysis Report - RawPOS Malware: Deconstructing an Intruder’s Toolkit. Retrieved October 4, 2017.
url: https://www.kroll.com/en/insights/publications/malware-analysis-report-rawpos-malware
source_name: TrendMicro RawPOS April 2015
description: TrendLabs Security Intelligence Blog. (2015, April). RawPOS Technical Brief. Retrieved October 4, 2017.
url: http://sjc1-te-ftp.trendmicro.com/images/tex/pdf/RawPOS%20Technical%20Brief.pdf
source_name: Visa RawPOS March 2015
description: Visa. (2015, March). Visa Security Alert: "RawPOS" Malware Targeting Lodging Merchants. Retrieved October 6, 2017.
url: https://usa.visa.com/dam/VCOM/download/merchants/alert-rawpos.pdf
source_name: Mandiant FIN5 GrrCON Oct 2016
description: Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.
url: https://www.youtube.com/watch?v=fevGZs0EQu8
source_name: DarkReading FireEye FIN5 Oct 2015
description: Higgins, K. (2015, October 13). Prolific Cybercrime Gang Favors Legit Login Credentials. Retrieved October 4, 2017.
url: https://www.darkreading.com/analytics/prolific-cybercrime-gang-favors-legit-login-credentials/d/d-id/1322645?
source_name: Github Mempdump
description: DiabloHorn. (2015, March 22). mempdump. Retrieved October 6, 2017.
url: https://github.com/DiabloHorn/mempdump
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:44:08.401Z
name: RawPOS
description: [RawPOS](https://attack.mitre.org/software/S0169) is a point-of-sale (POS) malware family that searches for cardholder data on victims. It has been in use since at least 2008. (Citation: Kroll RawPOS Jan 2017) (Citation: TrendMicro RawPOS April 2015) (Citation: Visa RawPOS March 2015) FireEye divides RawPOS into three components: FIENDCRY, DUEBREW, and DRIFTWOOD. (Citation: Mandiant FIN5 GrrCON Oct 2016) (Citation: DarkReading FireEye FIN5 Oct 2015)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Walker Johnson
x_mitre_aliases: RawPOS
FIENDCRY
DUEBREW
DRIFTWOOD