Home Malware Programs Trojans SUCEFUL

SUCEFUL

Posted: September 15, 2015

Threat Metric

Ranking: 9,582
Threat Level: 9/10
Infected PCs: 246,049
First Seen: September 15, 2015
Last Seen: March 3, 2025
OS(es) Affected: Windows

SUCEFUL is a spyware program specializing in taking control over both ATMs and, potentially, any cards used with the infected machine. Although no SUCEFUL campaigns have been found 'in the wild,' immediate deployment of SUCEFUL could result in the theft of credit-related information from customers with no further coding needed. As with other ATM-based threats, malware experts recommend that employees pay close attention to physical security measures and respond to any suspected compromises with appropriate anti-malware tools for uninstalling SUCEFUL.

The Latest Evolution in ATM Trojans

SUCEFUL is a landmark in Trojan development for Automated Teller Machine attacks, albeit one capable of exhibiting extremely obvious symptoms. This Trojan was designed specifically for ATMs, with full compatibility with the XFS Manager interface, making it a platform and vendor-agnostic threat that may infect most ATMs regardless of their affiliations. Unlike most financial spyware, SUCEFUL doesn't necessarily harvest information from compromised machines silently. Instead, SUCEFUL may use its XFS feature set to withhold the physical credit cards of any customers.

SUCEFUL's attacks only are possible due to its coders being well-versed in ATM code infrastructure. The result is a piece of threat that reads both chip and track strip data, exerts physical control over the card's state of ejection, disables standard security sensors and operates the number pad input. These capabilities, when combined with SUCEFUL's general XFS-based compatibility and choice of targets, makes SUCEFUL the first of its kind, in many ways.

On the other hand, malware researchers have yet to see any confirmed campaigns for SUCEFUL in operation. This absence of SUCEFUL in operation could indicate that, despite its full set of features, SUCEFUL still is under development. Alternately, its coders may be refining the ideal business models for putting SUCEFUL into play, such as the third-party rentals preferred by developers of some file encryption Trojans.

Erasing SUCEFUL's Potential as Easily as Correcting a Typo

SUCEFUL gains its name from a misspelling of 'successful' by its estimated development team. Like that simple typo, SUCEFUL's estimated distribution methods all require sloppy behavior that one could remedy with appropriate security protocols. Physical access normally is required for installing SUCEFUL or benefiting from some of its most significant functions. Common sense measures like security cameras and hiring trustworthy employees can provide businesses with a good baseline of protection against SUCEFUL's being installed, or taking advantage of its installation. As always, dedicated anti-malware tools should be used whenever one removes SUCEFUL or similarly advanced spyware from any machine.

SUCEFUL is historically significant, perhaps most notably in showing how much work third parties will go to for access 'free' money. In designing a Trojan that custom-fits to the internal architecture of ATM systems without any regard for vendors or brand names, SUCEFUL's developers have shown significant insider knowledge of the industry. SUCEFUL's potential deployment also, ironically, points to people being targeted as the weakest security links in financial transactions. Although SUCEFUL's first upload for anti-malware analysis comes from Russia, nothing about SUCEFUL's feature set is believed to be specific to that region.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to SUCEFUL may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

* See Free Trial offer below. EULA and Privacy/Cookie Policy.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Technical Details

Registry Modifications

The following newly produced Registry Values are:

Regexp file mask%LOCALAPPDATA%\petgame.exe%UserProfile%\Local Settings\Application Data\petgame.exe%windir%\branding\[RANDOM CHARACTERS].pngHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}PetGame
Loading...
Spywareremove.com uses cookies to provide you with a better browsing experience and analyze how users navigate and utilize the Site. By using this Site or clicking on "OK", you consent to the use of cookies. Learn more.