The Lab Blog

Radare2 has been receiving a lot of attention lately. Rather than browsing through some of the documentation, I decided to try and port some existing code to use Radare.

Yet another new credit card dumping utility has been discovered. BernhardPOS is named after (presumably) its author who left in the build path of "C:bernhardDebugbernhard.pdb" and also uses the name Bernhard in creating the mutex "OPSEC_BERNHARD". This utility does several interesting things to evade antivirus detection. We’ll talk over some of them in detail. Details about the sample, including a hash are available at the end of this writeup.

The Home Depot breach was a very high profile case this year, which brought the security of point of sale machines into the spotlight. After some mumblings and a bunch of misinformation about who/what and how the attack came about, little pieces of information started to make their way to the surface. Several of which were reports a new malware dubbed “Mozart.”

Morphick

Morphick Cyber Security, Inc

Recent Posts From The Lab

• Writing a Malware Config Parser Using Radare2 and Ruby
• BernhardPOS - New POS Malware Discovered by Morphick
• Webshells and MOF
• TrueCrypt's Egress
• Morphick Raises $10M In Series A Funding to Meet Demand as Businesses Look to Implement Defenses That Can Change as Quickly as Attackers Change Their Strategies
• From the Back Room to the Boardroom - Making IT Security a Business Partner
• Morphick releases free tool to identify homograph based attacks.