Loading malware…
Skimer is a Windows-based ATM backdoor that combines virtual skimming with unauthorized cash dispensing. First publicly documented in 2009, it initially targeted Diebold ATMs in Russia and Ukraine. It is used by financially motivated criminals to steal payment-card and transaction data and to withdraw cash without legitimate bank authorization. Early infections required manual installation and operator authentication through authorization codes or specially prepared cards.
Skimer can capture magnetic-stripe Track 1 and Track 2 data and record PIN-pad input. The 2009 variant supported data collection and cash dispensing, whereas the 2011 variant focused on data collection and encrypted its logs with RC4. Later versions integrate with ATM XFS services to access peripherals and expose an authenticated command interface through the PIN pad. Operators activate the malware using specially crafted cards and can dispense cash, collect and print stolen card details, update the malware, or remove it.
An improved version identified in 2016 patches an ATM service executable to load a malicious library when the service starts, establishing persistence across reboots. It uses Themida packing and, on NTFS systems, alternate data streams to conceal components and collected information. Skimer directly threatens banks and other ATM-operating financial institutions, as well as cardholders whose payment data is captured.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
After successful installation, the sample patches the XFS executable (SpiService.exe) entry point, in order to add a LoadLibrary call to the dropped netmgr.dll file.
A recent review of its functionality also indicates that it may also attempt to steal users' PINs by retrieving the encrypted pin pad encryption keys from the system.
C:\Windows\Temp\attrib4 logs data from different APIs responsible for the communication with the keyboard (effectively logging data such as the pin)
all of the known ATM malware attacks provide the attackers a way to install arbitrary programs on the cash machines in order to empty their cash cassettes (i.e., jackpotting the machine), log all customer card transactions (i.e., virtual skimming), or both.
Skimer functions as a virtual skimming device that attempts to steal bank card numbers and details of the account and owner details stored on the magnetic stripe tracks 1 and 2.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Included in a background list of ATM jackpotting malware. No Skimer-specific capabilities, vulnerabilities, or threat actor relationships are described.
ATM malware/backdoor that infects ATM systems, patches the XFS service executable to load a malicious DLL, activates when a specially crafted magic card is inserted, authenticates operators with a session key, and supports cash dispensing, card data collection, PIN/API logging, self-deletion, debugging, and malware updates.
ATM malware that steals card data from magnetic stripe tracks, may retrieve PIN-related encryption material, and provides a backdoor menu for operators to trigger cash dispensing from ATM cash modules.
ATM malware targeting Diebold ATMs; used for jackpotting and virtual skimming. v2009 can read PIN pad input, dispense cash, and collect transaction data, while v2011 focuses on collecting transaction/card data and encrypting logs.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.