[Artilllerie]

Hello,

Attached the sample of this report :
https://www.fireeye.com/blog/threat-res ... warea.html

[flrud2208]

Thanks this will help in further analysing and detection of the malware.

[Xylitol]

Code: Select all

Text string=ASCII "Developed by kernyv@jabbim.com"

[oilen]

Attacks all three major vendors. Packed with UPX. Connects directly to XFS services using CDM (cash dispenser) ,PIN(Keypad) and IDC(card reader). Erases a lot of vendor specific logs. Kills main application processes before executing any dispense, in an attempt to hide it's presence for longer.Can stop network in order to avoid uplink notification of dispense for the monitored machines.

Regards,
JD

[sadfud]

Unpacked sample. Additional protection detected: IsDebuggerPresent

YARA Rule:

Code: Select all

rule Ripper_ATM
{
    meta:
    Description = "RIPPER ATM MALWARE"
    Author = "SadFud"
    Date = "02/09/2016"
    Hash = "cc85e8ca86c787a1c031e67242e23f4ef503840739f9cdc7e18a48e4a6773b38"
    VT Scan = "https://www.virustotal.com/es/file/cc85e8ca86c787a1c031e67242e23f4ef503840739f9cdc7e18a48e4a6773b38/analysis/"
    
    strings:
    $a = { 6b 65 72 6e 79 76 40 6a 61 62 62 69 6d 2e 63 6f 6d }
	  
    
    condition:
    $a 
    
}