Backdoor.MacOS.APPLEJEUS.YEBBW

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following files:

• /Library/JMTTrader/CrashReporter -> drops malicious file
• /Library/LaunchDaemons/org.jmtrading.plist

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• exit -> Terminates the process
• kcon
• up -> creates and writes a file from C&C
• any other input from C&C will execute the strings with popen() command

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• https://{BLOCKED}oc.com/grepmonux.php

Other Details

This Backdoor does the following:

• This file is usually included in a malicious pkg file that has a postinstall script. Having this file installed in the system gives an indication of a malware present in system.
• This file itself was seen only to be bystander application that is installed