Skip to content
MalwareWiki

Malware

AbaddonPOS

aka PinkKite · TinyPOS

MajorGeeks describes this malware as trying to locate credit card data by reading the memory of all processes except itself by first blacklisting its own PID using the GetCurrentProcessId API.

AbaddonPOS, also known as PinkKite, TinyPOS, is a Windows malware family.

Background

As described by MajorGeeks, this malware hunts for credit card data by scanning the memory of every running process apart from its own, which it excludes by first identifying its PID via the GetCurrentProcessId API. After locating card data, it transmits the stolen information to a command-and-control server over a custom binary protocol rather than HTTP.

Source: Malpedia (Fraunhofer FKIE).