"The main Trojan executable contains the code to handle the magnetic card reader using undocumented Diebold Agilis 91x functions, inject code to ATM’s processes

"The main Trojan executable contains the code to handle the magnetic card reader using undocumented Diebold Agilis 91x functions, inject code to ATM’s processes, parse transactions in Ukrainian, Russian and US currencies and use printer, probably for printing the stolen data. I am also fairly sure that some of the instructions to the keyboard for typing PIN numbers are connected with hooks to log the captured PINs." And "By uncovering code that appears to encrypt data and a possible alternative user interface it seems to me that the stolen data is encrypted, probably to allow the attackers to use “money mules” to retrieve the data in person." Just wow. ZeroDay has more on this http://blogs.zdnet.com/security/?p=2908 http://blogs.zdnet.com/security/?p=2908