Ploutus is one of the most advanced ATM malware families we’ve seen in the last few years. Discovered for the first time in Mexico back in 2013, Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message , a technique that had never been seen before.
FireEye Labs recently identified a previously unobserved version of Ploutus, dubbed Ploutus-D, that interacts with KAL’s Kalignite multivendor ATM platform. The samples we identified target the ATM vendor Diebold. However, minimal code change to Ploutus-D would greatly expand its ATM vendor targets since Kalignite Platform runs on 40 different ATM vendors in 80 countries .
Once deployed to an ATM, Ploutus-D makes it possible for a money mule to obtain thousands of dollars in minutes. A money mule must have a master key to open the top portion of the ATM (or be able to pick it), a physical keyboard to connect to the machine, and an activation code (provided by the boss in charge of the operation) in order to dispense money from the ATM. While there are some risks of the money mule being caught by cameras, the speed in which the operation is carried out minimizes the mule’s risk.
This blog covers the changes, improvements, and Indicators of Compromise (IOC) of Ploutus-D in order to help financial organizations identify and defend against this threat.
Previously unobserved features of Ploutus-D
It uses the Kalignite multivendor ATM Platform.
It could run on ATMs running the Windows 10, Windows 8, Windows 7 and XP operating systems.
It is configured to control Diebold ATMs.
It has a different GUI interface.
It comes with a Launcher that attempts to identify and kill security monitoring processes to avoid detection.
It uses a stronger .NET obfuscator called Reactor.
Commonality between Ploutus and Ploutus-D
The main purpose is to empty the ATM without requiring an ATM card.
The attacker must interact with the malware using an external keyboard attached to the ATM.
An activation code is generated by the attacker, which expires after 24 hours.
Both were created in .NET.
Can run as Windows Service or standalone application.
Ploutus-D (observed in the wild with the filename of “AgilisConfigurationUtility.exe”) can run as a standalone application or as a Windows service started by a Launcher (observed in the wild as “Diebold.exe”). Although multiple functionality is shared between the two components, the main difference is that Ploutus-D is the component with the capability to dispense money.
Table 1: Launcher Properties
This time, the attackers put more effort into trying to obfuscate and protect their code from reverse engineering by switching from .NET Confuser to Reactor. A quick look at how the protected code appears is shown in Figure 1.
Figure 1: Code protected by Reactor
Once the code is deobfuscated, it is easy to understand the internal workings. Before the Launcher execution starts, it will perform an integrity check on itself to make sure it has not been altered.
The Launcher can receive different arguments in the command line to either install as a service, run Ploutus-D, or uninstall from the machine. The service properties can be seen in Figure 2.
Figure 2: Service Description of the Launcher
Using a very common persistence technique, the malware will add itself to the “Userinit” registry key to allow execution after every reboot. The key is located at:
\HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
The attacker must interact with the Launcher by attaching a keyboard to the ATM USB or PS/2 port. Figure 3 below shows an example of this setup.
Figure 3: Keyboard attached to the ATM port
Once the Launcher has been installed in the ATM, it will perform keyboard hooking in order to read the instructions from the attackers via the external keyboard. A combination of “F” keys will be used to request the action to execute (see Figure 4).
Figure 4: Interacting with the Launcher via keyboard
The main tasks supported are:
Start programs on demand, some of which are decrypted from the resource section of the Launcher: C:\Program Files\Diebold\Agilis Startup\AgilisShellStart.exe Main.exe XFSConsole.exe
C:\Program Files\Diebold\Agilis Startup\AgilisShellStart.exe
Kill Processes: NHOSTSVC.exe AgilisConfigurationUtility.exe XFSConsole.exe
AgilisConfigurationUtility.exe
Delete Files: NetOp.LOG – Secure Remote Management solution
NetOp.LOG – Secure Remote Management solution
Reboot Machine: “wmic os where Primary='TRUE' reboot”
“wmic os where Primary='TRUE' reboot”
As seen in Figure 5, a request has been sent to run Ploutus-D (AgilisConfigurationUtility.exe) from command line.
Figure 5: Starting Ploutus-D by the Launcher
Legitimate KAL ATM software is dropped into the system along with Ploutus-D, as shown in the Figure 6. The reason for this is to make sure that all the software and versions needed to properly run the malware are present in the same folder to avoid any dependency issues. The same technique was also used by the first version of Ploutus.
Figure 6: Dropped files by the Launcher
The K3A.Platform.dll DLL will load the Kalignite Platform to allow Ploutus-D to control the ATM.
This shows that the attackers likely have access to the targeted ATM software. They can either buy physical ATMs from authorized resellers, which come preloaded with vendor software, or they could just steal the ATMs directly from the bank’s facility. An example of a real incident reported in Mexico is shown in Figure 7.
Figure 7: Attackers physically stealing ATMs
Table 2: Ploutus-D Properties
Similar to the Launcher, this binary also came protected with Reactor obfuscator (see Figure 8).
Figure 8: Protected with Reactor
Looking at the unprotected code (see Figure 9), the connection with Ploutus became evident since the names of most of the functions are the same as in the first version.
Figure 9: Unprotected code
Ploutus-D will make sure a mutex with the name “KaligniteAPP” does not exist in the system in order to start running. Similar to the Launcher, Ploutus-D will hook the keyboard in order for the attackers to interact with it; however, apart from receiving commands from “F” keys, it will also read from the numeric pad (numbers).
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
