The complete source code of the Carbanak malware was been discovered by the security researchers. Carbanak which is also referred as FIN7, Anunak or Cobalt is one of the most full-featured, dangerous malware which were used for attacks against banks, financial institutions, hospitals, and restaurants. It belongs to an APT-style cybercriminal group.
Last year there was a speculation that the Carbanak source code was leaked which was later confirmed by the security researchers at Kaspersky lab that the code does not belong to Carbanak.
This time, the security researchers from FireEye disclosed that they found Carbanak’s source code, builders, and some previously unseen plugins in two RAR archives which were uploaded on the VirusTotal malware scanning engine two years ago from a Russian IP address.
According to the researchers, CARBANAK source code was 20MB consisting of 755 files, with 39 binaries and 100,000 lines of code.
The researchers might soon release articles explaining the CARBANAK features and analysis based upon its source code and reverse engineering.
Carbanak was initially discovered in 2014 by Kaspersky Lab and is one of the most successful malware attacks launched by a highly organized group who aimed at conducting cybercrime at the same time avoiding being detected by potential targets and the authorities.
The hacker group started their cybercrimes around six years ago by launching a series of malware attacks using Anunak and Carbanak to compromise banks and ATM networks worldwide. They managed to rob more than billion euros from hundreds of banks across the globe.
The hackers compromised the banks by sending malicious spear-phishing emails to different employees at various banks. These mails when opened infects the computers with Carbanak malware thereby letting the hackers to transfer money from the targeted banks to fake accounts or ATMs owned by them.
The hacker’s group was first uncovered in 2015 and three suspects, all from Ukraine and one of whom were believed to be the leader of the group were arrested last year.