Lockpos

Overview

Trojan:Win32/Lockpos is a highly specialized InfoStealer designed with a singular focus: the theft of credit card and payment data from Point-of-Sale (PoS) systems, hospitality networks, and e-commerce endpoints. The name relates to its target (PoS systems) and its objective to lock onto valuable financial data (`T1005`).

Understanding Lockpos (PoS/Credit Card Stealers)
To an end-user or cashier, the infection is entirely invisible; the PoS terminal functions normally. For a business, Lockpos represents a catastrophic data breach leading to massive PCI-DSS compliance fines, reputational destruction, and financial liability as customer cards are cloned and abused.

Execution and Extraction Mechanics
Lockpos is typically deployed after an attacker has breached a corporate network (often via exposed RDP or weak vendor credentials) and pivoted to the isolated PoS VLAN. Upon execution, it establishes stealthy persistence (e.g., as a hidden Windows Service). Its primary mechanism is 'RAM Scraping' (`T1005`). It continuously scans the volatile memory (RAM) of running processes (like the POS application itself, e.g., `pos.exe`) looking for Track 1 and Track 2 magnetic stripe data. Before exfiltrating the data, it frequently validates the scraped numbers, discarding junk data to keep its exfiltration footprint minimal (`T1041`). It often injects itself into `explorer.exe` to hide its network traffic.

Indicators of Compromise & Impact
The impact is the mass compromise of customer financial data. Host-based IoCs include EDR alerts for anomalous processes constantly calling `ReadProcessMemory` against legitimate PoS applications, and the creation of hidden, encrypted staging files in `%Temp%` containing the validated card data. Network IoCs include a 'beacon' or exfiltration burst over HTTP/HTTPS, DNS tunneling, or ICMP to a C2 server, occurring at regular intervals or at the end of the business day.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_LOCKPOS {
    meta:
        description = "Detects Lockpos (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "lockpos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Lockpos Activity
id: c10811d9582d66c38205a908c5bfcb87
status: experimental
description: Detects generic indicators of the lockpos malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*lockpos*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the affected PoS terminals from the internet and the broader corporate network.
2. Do not reboot the PoS terminals until a full memory dump (RAM) has been captured, as the malware operates heavily in memory and may store unexfiltrated cards there.
3. Engage a specialized Payment Card Industry (PCI) forensic investigator (PFI) to determine the scope of the cardholder data breach.
4. Review network segmentation to determine how the attacker pivoted from the corporate network into the isolated PoS environment.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not attempt to 'clean' a compromised PoS terminal; it must be completely wiped and reimaged from a known-good, secure baseline.
2. Avoid relying solely on traditional AV on PoS systems; application whitelisting (AppLocker) is required to prevent unauthorized memory scrapers from running.

References & External Analysis

• Search "lockpos" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Favadd
• Clipbanker
• Dynamer
• Apost
• Amavaldo

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/lockpos.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.