It then runs two files, compenum.exe and shareanum.exe, used to map network shares and list other PoS systems on the network. RawPOS then proceeds to install memory dumper and data aggregator components on the newly discovered systems. It centralizes the stolen data, determines if further access to the host is required, and then exfiltrates the payment card data. Some investigations have revealed that payment card data scraped by RawPOS had been moved to a non-PoS system prior to exfiltration to avoid detection. Additional files associated with RawPOS include: mmc.exe, vsssvc.exe, visaudp.exe, psex.exe, sdelete.exe, se.exe, framepkg.exe, and spoolsv.chm.
Victims of RawPOS campaigns include casinos, resorts, hotels, and retailers.