ATMJaDi

In order to be installed, the attackers must gain access to the bank’s network. This suggests the attackers first compromise the bank’s infrastructure.

The “/root” path accepts a POST request body and passes it as a shell command to cmd.exe, returning the resulting output.

It allows the criminals to paste and run any JavaScript code on a victim ATM and see what it returns.

Once installed and executed, the malware, in the form of a Java archive file called “INJX_PURE.jar”, looks for the process that controls the ATM and injects itself into it, giving it control of the legitimate ATM process.

ATMJadi originated in Latin America... But what’s perhaps most interesting is the false flag section with strings in the Russian language.

Once installed and executed, the malware, in the form of a Java archive file called “INJX_PURE.jar”, looks for the process that controls the ATM and injects itself into it, giving it control of the legitimate ATM process.

“/mgr for the manager, which gives criminals access to a list of all running classes for the attached Java virtual machine”

So the criminals must have network access to the target ATM. This makes us believe that the criminals have compromised the bank’s infrastructure to gain access to the network that the ATMs are connected to.

The malware can’t be controlled via the ATM keyboard or touchscreen, because it runs a self-crafted HTTP server web interface for its purpose.

“/core allows the criminals to load a specified .jar file from the victim file system”