Backdoor.MacOS.APPLEJEUS.YEBBW

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Ejecuta comandos desde un usuario remoto malicioso que pone en peligro el sistema afectado.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• /Library/JMTTrader/CrashReporter -> drops malicious file
• /Library/LaunchDaemons/org.jmtrading.plist

Rutina de puerta trasera

Ejecuta los comandos siguientes desde un usuario remoto malicioso:

• exit -> Terminates the process
• kcon
• up -> creates and writes a file from C&C
• any other input from C&C will execute the strings with popen() command

Otros detalles

Hace lo siguiente:

• This file is usually included in a malicious pkg file that has a postinstall script. Having this file installed in the system gives an indication of a malware present in system.
• This file itself was seen only to be bystander application that is installed