Cherry Picker

MITRE ATT&CK: S0107 View on attack.mitre.org

Aliases: Cherry Picker

First seen
2011-06-01 00:00:00
Malware type
spyware, trojan
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 14:52:28

Targeted industries: retail-and-hospitality financial-services

Context

Cherry Picker is a point of sale (PoS) memory scraper.

Detection coverage

  • 22 Sigma rules

Malware & tools used

  • File Deletion (attack-pattern)
  • AppInit DLLs (attack-pattern)
  • Exfiltration Over Unencrypted Non-C2 Protocol (attack-pattern)

Reports & references

  • trustwave.com — Shining The Spotlight On Cherry Picker Pos Malware (report)
  • MITRE ATT&CK — S0107 (report)

External references