Backdoor:MSIL/Sidkey.A can be used to infect ATM machines to dispense money.
Installation
Backdoor:MSIL/Sidkey.A creates the following registry entry so that it runs each time the ATM machine starts:
In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "AptraDebug"
With data: "<malware path>\ulssm.exe"
It tries to take control of the PIN pad of an infected ATM machine and might display all the available keys. If the malware is not successful in taking control of the PIN pad, it deletes itself, including all registry entries and files.
Payload
Dispense money from ATM machines
Backdoor:MSIL/Sidkey.A creates a hidden window with name "APTRASST1" that will accept certain keys to enable the trojan. It can display the "ENTER SESSION KEY TO PROCEED!" screen which can accept keys and run the following ATM machine operations:
- Disable the local area connection, to avoid alarm.
- Delete traces of the malware, including files and registry.
- Extend session time. When successful the machine will display "TIME WAS EXTENED. +++".
- Display cassette information by showing "Nr. of cash unit structures is: <Number>". This shows how much money is left for that specific cassette.
This threat can dispense money from a specific cassette number. When this is successful the machine displays the following message:
DISABLING LOCAL AREA NETWORK...
PLEASE WAIT..."
DISPENSE PERMISSION GRANTED
TO START DISPENSE OPERATION -
ENTER CASSETTE NUMBER AND PRESS ENTER.
If the attack is not successful, the ATM machine will display the following message:
INVALID CASSETTE NUMBER!
INVALID CASSETTE NUMBER. TRY AGAIN.
TO START DISPENSE OPERATION -
ENTER CASSETTE NUMBER AND PRESS ENTER.
If the operation is still not successful, it will display the following messages and wait for the correct key:
DISPENSE OPERATION DENIED. ENTER SESSION KEY.
Analysis by Ferdinand Plazo
