MalwarePublished 15 Nov 2016Updated 3 Jun 2025

tlp white · OSINT - Kronos Banking Trojan Used to Deliver New Point-of-Sale Malware

Affects tlp whiteSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

OSINT - Kronos Banking Trojan Used to Deliver New Point-of-Sale Malware

Impact

For European organizations, especially those in retail, hospitality, and financial sectors, this threat poses significant risks. Compromise by Kronos followed by POS malware installation can lead to large-scale theft of payment card data, resulting in financial losses, regulatory penalties under GDPR for data breaches, and reputational damage. Financial institutions may also face increased fraud attempts due to stolen banking credentials. The multi-stage nature of the attack complicates detection and response efforts. Organizations with POS systems that are not adequately segmented or monitored are particularly vulnerable. Additionally, the theft of payment card data can lead to downstream fraud affecting European consumers and businesses. The low severity rating in the original report may underestimate the potential impact if the malware campaign is successful, as POS malware infections have historically led to major breaches in Europe.

Defensive guidance

European organizations should implement network segmentation to isolate POS systems from general corporate networks, reducing the risk of lateral movement by malware like Kronos. Deploy advanced endpoint detection and response (EDR) solutions capable of identifying multi-stage malware behavior, including unusual process spawning and network communications indicative of banking Trojans and POS malware. Regularly update and patch all systems, including POS terminals and endpoint devices, even though no specific patch exists for this malware, to reduce the attack surface. Employ strict access controls and multi-factor authentication for systems handling financial transactions. Monitor network traffic for anomalies such as unexpected data exfiltration or connections to known malicious command and control servers associated with Kronos. Conduct regular security awareness training to reduce the risk of initial infection vectors such as phishing. Finally, implement robust logging and incident response plans to quickly detect and contain infections.

Indicators of compromise

Domains 1

RIG-v domain on Nov 8

add.souloventure.org

URLs 13

http://invoice.docs-sharepoint.com/profile/profile.php?id=[base64 e-mail address]Phishing link on Nov 8
http://invoice.docs-sharepoint.com/profile/download.phpRedirect from phishing link on Nov 8
https://feed.networksupdates.com/feed/webfeed.xmlZeuS C&C on Nov 8
http://info.docs-sharepoint.com/officeup.exeEmployeeID-847267.doc downloading payload (Kronos) on Nov 10
http://www.networkupdate.club/kbps/connect.phpKronos C&C on Nov 10
http://networkupdate.online/kbps/upload/c1c06f7d.exePayload DL by Kronos on Nov 10
http://networkupdate.online/kbps/upload/1f80ff71.exePayload DL by Kronos on Nov 10
http://networkupdate.online/kbps/upload/a8b05325.exePayload DL by Kronos on Nov 10
http://intranet.excelsharepoint.com/profile/Employee.php?id=[base64 e-mail address]Phishing link on Nov 10
http://webfeed.updatesnetwork.com/feedweb/feed.phpSmokeLoader C&C

Hashes 44

4b5f4dbd93100bb7b87920f2f3066782a8449eb9e236efc02afe570c1ce70cf5
711431204071b1e6f5b5644e0f0b23464c6ef5c254d7a40c4e6fe7c8782cd55c
90063c40cb94277f39ca1b3818b36b4fa41b3a3091d42dfc21586ad1c461daa0
4ba3913d945a16c099f5796fdeef2fda5c6c2e60cb53d46a1bfae82808075d74
a78b93a11ce649be3ca91812769f95a40de9d78e97a627366917c4fcd747f156
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
d0caf097ea0350dc92277aed73b0f44986d7d85b06d1d17b424dc172ce35a984
d9d1f02c8c4beee49f81093ea8162ce6adf405640ccacd5f03ce6c45e700ee98
093c81f0b234c2aa0363129fdaaaf57551f161915da3d23f43a792b5f3024c1e
fd5412a7c71958ecdffa7064bf03c5f1931e561a1e71bc939551d5afb8bf7462

Link 12

https://www.proofpoint.com/us/threat-insight/post/kronos-banking-trojan-used-to-deliver-new-point-of-sale-malware
https://www.virustotal.com/file/d0caf097ea0350dc92277aed73b0f44986d7d85b06d1d17b424dc172ce35a984/analysis/1532343224/
https://www.virustotal.com/file/d9d1f02c8c4beee49f81093ea8162ce6adf405640ccacd5f03ce6c45e700ee98/analysis/1532343304/
https://www.virustotal.com/file/4ba3913d945a16c099f5796fdeef2fda5c6c2e60cb53d46a1bfae82808075d74/analysis/1506533743/
https://www.virustotal.com/file/4b5f4dbd93100bb7b87920f2f3066782a8449eb9e236efc02afe570c1ce70cf5/analysis/1479409553/
https://www.virustotal.com/file/fd5412a7c71958ecdffa7064bf03c5f1931e561a1e71bc939551d5afb8bf7462/analysis/1500412803/
https://www.virustotal.com/file/269f88cfa9e9e26f3761aedee5d0836b5b82f346128fe03da28a331f80a5fba3/analysis/1489573838/
https://www.virustotal.com/file/711431204071b1e6f5b5644e0f0b23464c6ef5c254d7a40c4e6fe7c8782cd55c/analysis/1478793058/
https://www.virustotal.com/file/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855/analysis/1532551770/
https://www.virustotal.com/file/093c81f0b234c2aa0363129fdaaaf57551f161915da3d23f43a792b5f3024c1e/analysis/1513643179/

File 10

EmployeeID-847267.doc
EmployeeID-6283.doc
EmployeeID-47267.zip
EmployeeID-47267.zip
EmployeeID-47267.pif
EmployeeID-47267.pif
EmployeeID-847267.doc
c1c06f7d.exe
1f80ff71.exe
a8b05325.exe

Text 23

Banking Trojans continue to evolve and threat actors are using them in new ways, even as the massive Dridex campaigns of 2015 have given way to ransomware and other payloads. Most recently, we observed several relatively large email campaigns distributing the Kronos banking Trojan. In these campaigns, though, Kronos acted as a loader with a new Point-of-Sale (POS) malware dubbed ScanPOS as the secondary payload.
Malicious
Malicious
Malicious
Malicious
Malicious
Malicious
Malicious
Malicious
Malicious

Datetime 11

2018-07-23T10:53:44
2018-07-23T10:55:04
2017-09-27T17:35:43
2016-11-17T19:05:53
2017-07-18T21:20:03
2017-03-15T10:30:38
2016-11-10T15:50:58
2018-07-25T20:49:30
2017-12-19T00:26:19
2017-07-18T20:58:26

Community reviews

Loading reviews…