OSX_EXPLOIT.B

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It gathers certain information on the affected computer.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• TROJ_MDROP.OSX

Installation

This backdoor drops the following component file(s):

• /tmp/__system
• /Library/LaunchDaemons/systm
• ~/Library/Application Support/.realPlayerUpdate
• ~/Library/launchagents/realPlayerUpdate.plist
• /Library/Application Support/.realPlayerUpdate
• /Library/LaunchDaemons/realPlayerUpdate.plist

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Execute remote shell commands
• Download and Upload files

It connects to the following websites to send and receive information:

• alma.apple.{BLOCKED}ns.org

Information Theft

This backdoor gathers the following information on the affected computer:

• user's contact information

Stolen Information

This backdoor saves the stolen information in the following file:

• /tmp/tmpAdressbook.vcf - contains user's contact information

NOTES:

Its communication with the Command-and-Control (C&C) server is encrypted with AES key 12345678