# Point-of-Sale malware - MMON (aka KAPTOXA)

**reversing.fun/posts/2022/01/02/mmon.html**

.. January 2, 2022

Jan 2, 2022

MMON (aka KAPTOXA) is a command-line tool to find credit card data and other patterns
within a process memory address space.

Sample:
```
86dd21b8388f23371d680e2632d0855b442f0fa7e93cd009d6e762715ba2d054
PDB: P:\vm\devel\dark\mmon\Release\mmon.pdb

```
Available command-line options:

To search the process memory, MMON uses a combination of OpenProcess,
**VirtualQueryEx, ReadProcessMemory.**


-----

The CC tracks are validated with the Luhn algorithm:


-----

As seen below, MMON was able to find the dummy CC tracks within the notepad process
memory:


-----