malware

PUNCHTRACK S0197

Type: malware
Platform: Windows
Created: 18 April 2018
Last modified: 16 April 2025

PUNCHTRACK is non-persistent point of sale (POS) system malware utilized by FIN8 to scrape payment card data. [1] [2]

TechniquesBottom 12%

TacticsBottom 12%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0197

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)	Generic	test	pipe_created	windows	Sysmon	Collection Data from Local System	-	medium	Roberto Rodriguez @Cyb3rWard0g	2021-10-08	2023-11-30	1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
	An attempt to export an AWS EC2 instance has been detected. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Collection Data from Local System Exfiltration Transfer Data to Cloud Account	-	low	Diogo Braz	2020-04-16	2022-10-05	54b9a76a-3c71-4673-b4b3-2edb4566ea7b
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2023-02-15	2024-03-05	3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5
Splunk	This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Cloud Storage Collection Data from Local System	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
Splunk	This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
Splunk	This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Stealth Obfuscated Files or Information Execution User Execution	-	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	96bce783-c22e-4e48-8cf1-3eb2794c5083
Splunk	The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-09	2026-09-22	aeff2bb5-3483-48d4-9be8-c8976194be1e
Splunk	This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	a4c76d0a-56b6-44be-814b-939746c4d406
Splunk	This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. (...)	Generic	stable	configuration_change	-	Cisco IOS · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Web Service	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	1abce487-f480-4d5f-a551-01de0bece0bd
	Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton	2020-10-11	2023-02-01	74403157-20f5-415d-89a7-c505779585cf
	Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.	Generic	experimental	-	windows	WinEventLog System	Collection Data from Local System Credential Access OS Credential Dumping Security Account Manager	-	medium	Jason Mull	2025-05-12	—	882fbe50-d8d7-4e29-ae80-0648a8556866
Splunk	The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output). (...)	Anomaly	stable	process_creation	windows · linux	CrowdStrike · Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2026-03-03	2026-05-13	9a8d5516-4c5e-11ef-9d42-acde48001122
	Detects usage of base64 utility to decode arbitrary base64-encoded text	Generic	test	process_creation	linux	Sysmon	Stealth Obfuscated Files or Information	-	low	Daniil Yugoslavskiy, oscd.community	2020-10-19	2021-11-27	e2072cab-8c9a-459b-b63c-40ae79e27031
	Detects usage of base64 utility to decode arbitrary base64-encoded text	Generic	test	process_creation	macos	-	Stealth Obfuscated Files or Information	-	low	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-26	719c22d7-c11a-4f2c-93a6-2cfdd5412f68
	One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and M (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Local System	-	medium	frack113	2022-02-13	2024-03-05	6a69f62d-ce75-4b57-8dce-6351eb55b362
Splunk	This detection identifies access to sensitive system and configuration files on an ESXi host, including authentication data, service configurations, and VMware-specific management settings. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Collection Data from Local System Credential Access OS Credential Dumping /etc/passwd and /etc/shadow	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	6fa0073d-6ca0-4f93-913d-fb420c9de15b	-
Splunk	This detection identifies the use of a remote tool to download virtual machine disk files from a datastore. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Collection Data from Local System	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	2e155547-aaac-49d3-b0ef-ceabc31fd364	-
	Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2023-02-15	2025-06-04	cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7
	Detects the execution of certutil with the "encode" flag to encode a file to base64. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2019-02-24	2024-03-05	e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a
	Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-05-15	2024-03-05	82a6714f-4899-4f16-9c1e-9a333544d4c3
	Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data Staged Local Data Staging	-	medium	Nasreddine Bencherchali (Nextron Systems), frack113	2021-07-20	2022-10-09	85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98
	Detects Obfuscated use of Clip.exe to execute PowerShell	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2021-09-16	21e4b3c1-4985-4aa4-a6c0-f8639590a5f3
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2022-11-17	b222df08-0e07-11eb-adc1-0242ac120002
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2024-04-05	73e67340-0d25-11eb-adc1-0242ac120002
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2024-04-05	a136cde0-61ad-4a61-9b82-8dc490e60dd2
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	service	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2022-11-27	4edf51e1-cb83-4e1a-bc39-800e396068e3
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	service	windows	WinEventLog System	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2023-02-20	f7385ee2-0e0c-11eb-adc1-0242ac120002
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-12-29	7eedcc9d-9fdb-4d94-9c54-474e8affc0c7
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2023-03-04	c70731dd-0097-40ff-b112-f7032f29c16c
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	20e5497e-331c-4cd5-8d36-935f6e2a9a07
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	7034cbbb-cc55-4dc2-8dad-36c0b942e8f1
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	service	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	7a922f1b-2635-4d6c-91ef-af228b198ad3
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	service	windows	WinEventLog System	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	175997c5-803c-4b08-8bb0-70b099f47595
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2026-03-16	4bf943c6-5146-4273-98dd-e958fd1e3abf
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Unsupported	unsupported	driver_load	windows	Sysmon	Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-07-07	e75c48bd-3434-4d61-94b7-ddfaa2c08487
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-12-31	1b9dc62e-6e9e-42a3-8990-94d7a10007f7
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-12-31	2f211361-7dce-442d-b78a-c04039677378
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	service	windows	WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-11-27	fd0f5778-d3cb-4c9a-9695-66759d04702a
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	service	windows	WinEventLog System	Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-11-27	51aa9387-1c53-4153-91cc-d73c59ae1ca9
	Detects Obfuscated Powershell via RUNDLL LAUNCHER	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-03-08	03b024c6-aad1-4da5-9f60-e9e8c00fa64c
	Detects Obfuscated Powershell via RUNDLL LAUNCHER	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	e6cb92b4-b470-4eb8-8a9d-d63e8583aae0
	Detects Obfuscated Powershell via RUNDLL LAUNCHER	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	a23791fe-8846-485a-b16b-ca691e1b03d4
	Detects Obfuscated Powershell via RUNDLL LAUNCHER	Generic	test	service	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	f241cf1b-3a6b-4e1a-b4f9-133c00dd95ca
	Detects Obfuscated Powershell via RUNDLL LAUNCHER	Generic	test	service	windows	WinEventLog System	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	11b52f18-aaec-4d60-9143-5dd8cc4706b9
	Detects Obfuscated use of stdin to execute PowerShell	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2024-04-15	6c96fc76-0eb1-11eb-adc1-0242ac120002
	Detects Obfuscated use of stdin to execute PowerShell	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2021-09-17	de7fb680-6efa-4bf3-af2c-14b6d33c8e6e
	Detects Obfuscated use of stdin to execute PowerShell	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2024-04-05	779c8c12-0eb1-11eb-adc1-0242ac120002
	Detects Obfuscated use of stdin to execute PowerShell	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2024-04-05	9ac8b09b-45de-4a07-9da1-0de8c09304a3

Title

Description

PUNCHTRACK S0197

PUNCHTRACK S0197

PUNCHTRACK MITRE reference S0197

Standing S0197

Reach

Coverage

PUNCHTRACK detections S0197