Análisis realizado por : Karl Dominguez   
 Modificado por : Karl Dominguez

 Plataforma:

iOS

 Riesgo general:
 Potencial de destrucción:
 Potencial de distribución:
 Infección divulgada:
Bajo
Medio
High
Crítico

  • Tipo de malware
    Worm

  • Destructivo?
    No

  • Cifrado
    No

  • In the Wild:

  Resumen y descripción

Puede haberlo descargado inadvertidamente un usuario mientras visitaba sitios Web maliciosos. Puede haberlo instalado manualmente un usuario.

  Detalles técnicos

Tamaño del archivo Varía
Tipo de archivo Other
Residente en memoria No
Fecha de recepción de las muestras iniciales 21 noviembre 2009
Carga útil Steals information; Executes scripts received from its C&C server

Detalles de entrada

Puede haberlo descargado inadvertidamente un usuario mientras visitaba sitios Web maliciosos.

Puede haberlo instalado manualmente un usuario.

Instalación

Infiltra los archivos siguientes:

  • File name: /private/var/mobile/home/cydia.tgz
    Description: This is the main malware archive which contains the files INST, DUH, SYSLOG, curl_7.19.4-6_iphoneos-arm.deb,com.apple.period.plist, and com.apple.ksyslog.plist
  • File name: /private/var/mobile/home/.tmp
    Description: This is the file where /private/var/mobile/home/syslog stores received raw data from its command and control (C&C) server
  • File name: /private/var/mobile/home/sshd
    Description: Trend Micro detects this malicious executable as IOS_IKEE.A. It scans for IP addresses into which it will propagate to. It propagates by logging into the target iPhone via SSH using the default password, "alpine". It creates the folder, /private/var/mobile/home/, where it copies the malware package, CYDIA.TGZ. It then executes /private/var/mobile/home/inst to install the malware package.
  • File name: /private/var/mobile/home/duh
    Description: This is the malicious binary file used by this malware to issue HTTP GET commands. This is executed by /private/var/mobile/home/syslog to receive data from its C&C server.
  • File name: /private/var/mobile/home/inst
    Description: Trend Micro detects this malicious script as IOS_IKEE.A. It generates an ID for the infected iPhone which can be used as an identifier when this script connects to its C&C server. The generated ID is saved in /etc/rel. It then copies com.apple.ksyslog.plist to /System/Library/LaunchDaemons/com.apple.ksyslog.plist so that this script executes every time the infected device is turned on. In addition, it installs legitimate Debian packages necessary for its routines. It also changes the default SSH password, alpine that is saved in /etc/master.passwd to ohshit. This file is responsible for gathering all SMS messages and information about the infected device. SMS messages are saved in /private/var/mobile/home/{ID}/sms.txt while phone information are saved into /private/var/mobile/home/{ID}/info. It then archives the folder, /private/var/mobile/home/{ID}, and connects to its C&C server, {BLOCKED}.{BLOCKED}.38.16/xml/a.php?name={ID} to send the .TGZ file in base64 format.
  • File name: /private/var/mobile/home/heh
    Description: This file is where /private/var/mobile/home/syslog saves shell scripts to be executed.
  • File name: /private/var/mobile/home/syslog
    Description: Trend Micro detects this malicious script as IOS_IKEE.A. This file runs /private/var/mobile/home/duh and saves the C&C server replies to /private/var/mobile/home/.tmp. It parses the .TMP file for scripts then saves the result in /private/var/mobile/home/heh and executes this file as a shell script.
  • File name: /System/Library/LaunchDaemons/com.apple.ksyslog.plist
    Description: This daemon (a software that runs in the background) executes /private/var/mobile/home/sshd every time the infected iPhone device is started and keeps it running.
  • File name: /System/Library/LaunchDaemons/com.apple.period.plist
    Description: This daemon executes /private/var/mobile/home/syslog every 300 seconds.
  • File name: /System/Library/LaunchDaemons/com.apple.periodic.plist
    Description: This daemon file executes /private/var/mobile/home/syslog every 2000 seconds.
  • File name: /private/var/mobile/home/adv-cmds_119-5_iphoneos-arm.deb
    Description: This legitimate Debian package needed by this worm to execute its commands.
  • File name: /private/var/mobile/home/sqlite3_3.5.9-9_iphoneos-arm.deb
    Description: This is a legitimate Debian package file for an SQL database.
  • File name: /private/var/mobile/home/curl_7.19.4-6_iphoneos-arm.deb
    Description: This is a legitimate Debian package for Curl that is used to download and install adv-cmds_119-5_iphoneos-arm.deb and sqlite3_3.5.9-9_iphoneos-arm.deb from saurik.com.
  • File name: /private/var/mobile/home/{ID}/sms.txt
    Description: This file contains the stolen text messages.
  • File name: /private/var/mobile/home/{ID}/info
    Description: This file is where stolen data, such as the infected iPhone's name, version, and network interface information, is saved.
  • File name: /private/var/mobile/home/{ID}.tgz
    Description: This is an archive file containing files inside /private/var/mobile/home/{ID}/ that is sent to the C&C by /private/var/mobile/home/inst in base64 format.
  • File name: /etc/rel
    Description: This file contains the generated ID

Crea las carpetas siguientes:

  • /private/var/mobile/home
  • /private/var/mobile/home/{ID}

  Soluciones

Motor de exploración mínimo 8.900

Step 1

Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.

Step 2

Explorar el equipo con su producto de Trend Micro para eliminar los archivos detectados como IOS_IKEE.A En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.


Rellene nuestra encuesta!