SUCEFUL

Posted: September 15, 2015

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	852
Threat Level:	9/10
Infected PCs:	244,461

First Seen:	September 15, 2015
Last Seen:	October 17, 2023
OS(es) Affected:	Windows

SUCEFUL is a spyware program specializing in taking control over both ATMs and, potentially, any cards used with the infected machine. Although no SUCEFUL campaigns have been found 'in the wild,' immediate deployment of SUCEFUL could result in the theft of credit-related information from customers with no further coding needed. As with other ATM-based threats, malware experts recommend that employees pay close attention to physical security measures and respond to any suspected compromises with appropriate anti-malware tools for uninstalling SUCEFUL.

The Latest Evolution in ATM Trojans

SUCEFUL is a landmark in Trojan development for Automated Teller Machine attacks, albeit one capable of exhibiting extremely obvious symptoms. This Trojan was designed specifically for ATMs, with full compatibility with the XFS Manager interface, making it a platform and vendor-agnostic threat that may infect most ATMs regardless of their affiliations. Unlike most financial spyware, SUCEFUL doesn't necessarily harvest information from compromised machines silently. Instead, SUCEFUL may use its XFS feature set to withhold the physical credit cards of any customers.

SUCEFUL's attacks only are possible due to its coders being well-versed in ATM code infrastructure. The result is a piece of threat that reads both chip and track strip data, exerts physical control over the card's state of ejection, disables standard security sensors and operates the number pad input. These capabilities, when combined with SUCEFUL's general XFS-based compatibility and choice of targets, makes SUCEFUL the first of its kind, in many ways.

On the other hand, malware researchers have yet to see any confirmed campaigns for SUCEFUL in operation. This absence of SUCEFUL in operation could indicate that, despite its full set of features, SUCEFUL still is under development. Alternately, its coders may be refining the ideal business models for putting SUCEFUL into play, such as the third-party rentals preferred by developers of some file encryption Trojans.

Erasing SUCEFUL's Potential as Easily as Correcting a Typo

SUCEFUL gains its name from a misspelling of 'successful' by its estimated development team. Like that simple typo, SUCEFUL's estimated distribution methods all require sloppy behavior that one could remedy with appropriate security protocols. Physical access normally is required for installing SUCEFUL or benefiting from some of its most significant functions. Common sense measures like security cameras and hiring trustworthy employees can provide businesses with a good baseline of protection against SUCEFUL's being installed, or taking advantage of its installation. As always, dedicated anti-malware tools should be used whenever one removes SUCEFUL or similarly advanced spyware from any machine.

SUCEFUL is historically significant, perhaps most notably in showing how much work third parties will go to for access 'free' money. In designing a Trojan that custom-fits to the internal architecture of ATM systems without any regard for vendors or brand names, SUCEFUL's developers have shown significant insider knowledge of the industry. SUCEFUL's potential deployment also, ironically, points to people being targeted as the weakest security links in financial transactions. Although SUCEFUL's first upload for anti-malware analysis comes from Russia, nothing about SUCEFUL's feature set is believed to be specific to that region.

Technical Details

Registry Modifications

The following newly produced Registry Values are:

Regexp file mask%LOCALAPPDATA%\petgame.exe%UserProfile%\Local Settings\Application Data\petgame.exe%windir%\branding\[RANDOM CHARACTERS].pngHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}PetGame