Backdoor.MacOS.APPLEJEUS.YEBBW

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• /Library/JMTTrader/CrashReporter -> drops malicious file
• /Library/LaunchDaemons/org.jmtrading.plist

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• exit -> Terminates the process
• kcon
• up -> creates and writes a file from C&C
• any other input from C&C will execute the strings with popen() command

Andere Details

Es macht Folgendes:

• This file is usually included in a malicious pkg file that has a postinstall script. Having this file installed in the system gives an indication of a malware present in system.
• This file itself was seen only to be bystander application that is installed