ATM MALWARE

APPENDIX
RSA ECAT SAMPLE ANALYSIS
The following figure shows how the Yara rules match the sample analyzed. The RSA ECAT agent was deployed on Windows XP 32 bit
(operating system used on the tested ATMs):
Figure 12: ECAT ATM Malware Detected by Yara Signature
YARA RULES
rule Ploutus {
strings:
$s1 = "Confuser v1.9.0.0" wide ascii
$s2 = "Ploutos.exe" wide ascii
condition:
all of them and
// MZ signature at offset 0 and ...
uint16(0) == 0x5A4D and
// ... PE signature at offset stored in MZ header at 0x3C
uint32(uint32(0x3C)) == 0x00004550
}
rule Tyupkin {
strings:
$s1 = "\\ulssm.exe" wide ascii nocase
$s2 = "\\AptraDebug.lnk" wide ascii nocase
$s3 = "AptraDebug" wide ascii nocase
$s4 = "ulssm.Form1.resources" wide ascii nocase
$s5 = "MSVCR80.dll" wide ascii nocase
$s6 = "MSXFS.dll" wide ascii nocase
condition:
all of them and
// MZ signature at offset 0 and ...
uint16(0) == 0x5A4D and
// ... PE signature at offset stored in MZ header at 0x3C
uint32(uint32(0x3C)) == 0x00004550
}
rule Suceful {
strings:
$s1 = "vcl60.bpl" wide ascii nocase
$s2 = "Project1.exe" wide ascii nocase
$s3 = "SUCEFUL" wide ascii nocase
$s4 = "msxfs.dll " wide ascii nocase