ATMitch is a fileless ATM Malware that targets ATM machines remotely and delete evidence of attack. ATMitch operates by reading commands contained within a local text file labeled command.txt. The commands are simple, one-letter characters such as O for open dispenser, D for dispense, and E for Exit. Once an ATM is infected, threat actors can upload specific instructions to the command.txt file. ATMitch deletes itself and all related files once the attack is complete. It is suspected that threat actors deploy ATMitch after gaining access to a bank’s ATM network via Remote Desktop Protocol (RDP). Attacks involving ATMitch have been documented in Russia and Kazakhstan, although it is suspected that other countries have been impacted as well.
| 1065502d7171df7be3776b839410a227c540cd977e5e856bbbcd837b0872bdb6 | Backdoor.Win32.ATMitch.f | Download |
| ea5ebd1e5f98e10b1e7c834dd54707ad06772bccb4179cae7e50c7e6e772a1ab | Backdoor.Win32.ATMitch.a | Download |
| 66db5b6b5dc51de7e5380f214f703bdc69ab3c3bec7c3b67179940a06560f126 | HEUR:Trojan.Win32.ATMRod.gen | Download |