Alina

Alina is a Windows point-of-sale RAM-scraping malware family used to steal payment card data from retail payment environments. Active since at least late 2012, it is designed to inspect running processes on compromised POS systems, read process memory from non-blacklisted processes, and extract Track 1 and Track 2 payment card data for exfiltration to operator-controlled infrastructure over HTTP POST. Alina has been widely referenced alongside other major POS malware families such as Backoff, BlackPOS, Dexter, and JackPOS, and Backoff has been described as a successor that reused Alina-style installation techniques.

On execution, Alina installs itself on the victim host, commonly copying itself into the user application-data area under a benign-looking executable name, and establishes persistence through a Windows AutoStart Run entry. Reported variants create a mutex, gather basic host information such as the computer name, and launch the installed copy after setup. Alina also supports update behavior: it checks for newer versions and can replace an existing installation with an updated copy. Some analyses describe fallback installation names and registry-based persistence, reflecting multiple variants and ongoing development.

For collection, Alina enumerates running processes using standard Windows process-walking APIs, opens selected processes, and scans memory for payment-card track data while excluding blacklisted processes. Stolen data is then encoded and transmitted to hardcoded command-and-control infrastructure via HTTP POST. Multiple versions and variants have been observed, including a variant referred to as Eagle. Alina has been associated with criminal POS malware operations targeting merchant environments and retailers, particularly Windows-based POS terminals.