Press F3 for Money : “Ploutus” Dangerous ATM Malware Discovered

FireEye have recognized another variation of the Ploutus ATM malware, utilized for as far back as couple of years to make ATMs retch out money on charge.

Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message, a technique that had never been seen before.

There are some previously unobserved version of Ploutus, dubbed Ploutus-D, that interacts with KAL’s Kalignite multivendor ATM platform.

The samples we identified target the ATM vendor Diebold. However, minimal code change to Ploutus-D would greatly expand its ATM vendor targets since Kalignite Platform runs on 40 different ATM vendors in 80 countries

How it works

When conveyed to an ATM, Ploutus-D makes it feasible for a cash donkey to get a large number of dollars in minutes. A cash donkey must have an ace key to open the top segment of the ATM (or have the capacity to pick it), a physical console to interface with the machine, and an enactment code (gave by the manager accountable for the operation) keeping in mind the end goal to administer cash from the ATM.

FireEye described some previous Activities of  Ploutus,

• It uses the Kalignite multivendor ATM Platform.
• It could run on ATMs running the Windows 10, Windows 8, Windows 7 and XP operating systems.
• It is configured to control Diebold ATMs.
• It has a different GUI interface.
• It comes with a Launcher that attempts to identify and kill security monitoring processes to avoid detection.
• It uses a stronger .NET obfuscator called Reactor.

Commonality between Ploutus and Ploutus-D

• The main purpose is to empty the ATM without requiring an ATM card.
• The attacker must interact with the malware using an external keyboard attached to the ATM.
• An activation code is generated by the attacker, which expires after 24 hours.
• Both were created in .NET.
• Can run as Windows Service or standalone application.

New Ploutus malware variant targets Diebold-made ATMs

As indicated by Researchers, this new variation was seen in November 2016, when somebody transferred a duplicate on the VirusTotal amassed filtering motor.

This mix-up permitted Researcher’s to get their hands on a duplicate of this new form, which they nicknamed Ploutus-D because of elements that permitted it to explicitly target Diebold ATMs.

Later investigation uncovered that with minor adjustments, Ploutus-D could likewise focus on the ATMs of different sellers that fabricated their money distributors on the Kalignite Platform, at present conveyed by 40 diverse ATM merchants in 80 nations.

A Keyboard helps evildoers discharge out ATMs

Like past variations, hoodlums send Ploutus-D on the off chance that they can get to unsecured ATM ports where they associate a console to the ATM’s accessible ports.

The Keyboard permits them access to the ATM’s product. As per specialists, Ploutus-D can be utilized viably against ATMs running on Windows 10, 8, 7, and XP.

In the wake of associating the Keyboard, a charge line interface shows up, and cheats can utilize the console to enter blends of Fx keys to control the ATM, for example, “F8 F1” or “F8 F4 F5.”

After the convicts settle on the measure of money they need to take, they just need to press F3 and gather their cash.

FireEye Malware Analyst Daniel Regalado Said ,This code is provided by the boss in charge of the operation and is calculated based on a unique ID generated per ATM, and the current month and day of the attack,” 

Key Notes About Ploutus,

• Ploutus-D was uploaded to VirusTotal in November 2016.
• Ploutus-D was uploaded to VirusTotal in November 2016.
• It has been observed in Latin America.
• Ploutus-D affects Diebold ATMs.
• Minor modifications could be made to Ploutus-D to affect other vendors using the Kalignite Platform.
• It activity Through physical access to the ATM.
• Via an external keyboard that needs to be connected to the ATM.