Cutlet Maker

Cutlet Maker is a trojan used to target Wincor Nixdorf ATMs and empty the machines of all their banknotes. It was originally advertised for sale but the software has since been cracked and is now available to anyone for free. It is designed to run from a USB memory stick. The perpetrators need only attach the USB and an external keyboard and run the program. It relies on the Diebold Nixdorf DLL to send commands to the ATMs dispensing unit. The trojan is highly obfuscated with VMProtect.

When it was originally offered for sale, the buyer would be required to send the sellers a code that displays after the program runs order to receive the license code to unlock the program's "jackpotting" feature. Other criminals realized that the license code is not time-based, just an algorithm and were able to create a key generator that would automatically calculate the "license code" for them. The criminals posted the generator online for free for anyone to use. Other criminals have created a version of the original tool with the key generator for a much lower price.

Technical Details

  • Trend Micro provides technical details on Cutlet Maker here.