Retina Audits for Target POSRAM Malware

BeyondTrust Research Team, January 29th, 2014

By now, you’ve heard of the POSRAM malware used against retail giant Target to steal customers’ payment card information from point-of-sale terminals. If you have not heard of POSRAM, or are unfamiliar with how it works, the malware scans processes’ memory for credit card information and periodically uploads that information to an attacker controlled server. This allows malicious actors to use customer credit card information to make money.

In case you had not seen the latest updated audits in Retina, we have audits for detecting the POSWDS service and a file check for winxml.dll, both of which are primary indicators of a POSRAM infection:

  • 32588 – POSRAM Point of Sale (POS) Trojan Detected – POSWDS Service Running
  • 32594 – POSRAM Point of Sale (POS) Trojan Detected – winxml.dll Found

Scan your POS terminals now to ensure that you are POSRAM-free.