Author: Marvelous Pelin   
 

HEUR:Trojan-Spy.OSX.Aptordoc.c(Kaspersky)

 PLATFORM:

Windows

 OVER ALL RISK RATING:
 DAMAGE POTENTIAL::
 DISTRIBUTION POTENTIAL::
 REPORTED INFECTION:
 INFORMATION EXPOSURE:
Low
Medium
High
Critical

  • Threat Type:
    Trojan

  • Destructiveness:
    No

  • Encrypted:
    No

  • In the wild::
    Yes

  OVERVIEW

INFECTION CHANNEL: Descargado de Internet, Eliminado por otro tipo de malware

Modifica los archivos HOSTS del sistema afectado. Esto impide el acceso de los usuarios a determinados sitios Web.

  TECHNICAL DETAILS

File size: 170,014 bytes
File type: ZIP
Memory resident: Yes
INITIAL SAMPLES RECEIVED DATE: 13 de июля de 2017
PAYLOAD: Displays graphics/image

Modificar el archivo HOSTS

Modifica los archivos HOSTS del sistema afectado para que los usuarios no puedan acceder a los sitios Web siguientes:

    • 127.0.0.1 localhost
    • 255.255.255.255 broadcasthost
    • ::1 localhost
    • 127.0.0.1 metrics.apple.com
    • 127.0.0.1 ocsp.apple.com
    • 127.0.0.1 su.itunes.apple.com
    • 127.0.0.1 ax.su.itunes.apple.com
    • 127.0.0.1 swscan.apple.com
    • 127.0.0.1 swcdn.apple.com
    • 127.0.0.1 swdist.apple.com
    • 127.0.0.1 a1.phobos.apple.com
    • 127.0.0.1 a101.phobos.apple.com
    • 127.0.0.1 a102.phobos.apple.com
    • 127.0.0.1 a103.phobos.apple.com
    • 127.0.0.1 a104.phobos.apple.com
    • 127.0.0.1 a105.phobos.apple.com
    • 127.0.0.1 a11.phobos.apple.com
    • 127.0.0.1 a12.phobos.apple.com
    • 127.0.0.1 a13.phobos.apple.com
    • 127.0.0.1 a14.phobos.apple.com
    • 127.0.0.1 a15.phobos.apple.com
    • 127.0.0.1 access.apple.com
    • 127.0.0.1 advertising.apple.com
    • 127.0.0.1 albert.apple.com
    • 127.0.0.1 ali.apple.com
    • 127.0.0.1 ams.apple.com
    • 127.0.0.1 apple.apple.com
    • 127.0.0.1 apple.com
    • 127.0.0.1 appleconnect.apple.com
    • 127.0.0.1 appleid-it.apple.com
    • 127.0.0.1 appleid.apple.com
    • 127.0.0.1 appleseed.apple.com
    • 127.0.0.1 appleseed3.apple.com
    • 127.0.0.1 appleseedtest.apple.com
    • 127.0.0.1 aps.info.apple.com
    • 127.0.0.1 ara.apple.com
    • 127.0.0.1 arait.apple.com
    • 127.0.0.1 asia.apple.com
    • 127.0.0.1 asw.apple.com
    • 127.0.0.1 atlaslms.apple.com
    • 127.0.0.1 av.apple.com
    • 127.0.0.1 benefits.apple.com
    • 127.0.0.1 beta.apple.com
    • 127.0.0.1 bugreport.apple.com
    • 127.0.0.1 bugreporter.apple.com
    • 127.0.0.1 c.apple.com
    • 127.0.0.1 calendar.apple.com
    • 127.0.0.1 certifications-test.apple.com
    • 127.0.0.1 certifications.apple.com
    • 127.0.0.1 certifications2.apple.com
    • 127.0.0.1 checkcoverage.apple.com
    • 127.0.0.1 checkrepair.apple.com
    • 127.0.0.1 concierge-mobile.apple.com
    • 127.0.0.1 concierge.apple.com
    • 127.0.0.1 consultants.apple.com
    • 127.0.0.1 cooljobs.apple.com
    • 127.0.0.1 deimos.apple.com
    • 127.0.0.1 deimos2.apple.com
    • 127.0.0.1 deimos3.apple.com
    • 127.0.0.1 deploy.apple.com
    • 127.0.0.1 developer.apple.com
    • 127.0.0.1 developer2.apple.com
    • 127.0.0.1 developertest.apple.com
    • 127.0.0.1 devforums.apple.com
    • 127.0.0.1 devimages.apple.com
    • 127.0.0.1 diagnostics.apple.com
    • 127.0.0.1 discussions.apple.com
    • 127.0.0.1 documentation.apple.com
    • 127.0.0.1 downloads.apple.com
    • 127.0.0.1 ecommerce.apple.com
    • 127.0.0.1 employment.apple.com
    • 127.0.0.1 enterprise.apple.com
    • 127.0.0.1 ep.sap.apple.com
    • 127.0.0.1 erp.apple.com
    • 127.0.0.1 esp-test.apple.com
    • 127.0.0.1 esp.apple.com
    • 127.0.0.1 euro.apple.com
    • 127.0.0.1 events.apple.com
    • 127.0.0.1 ext.apple.com
    • 127.0.0.1 ext1.apple.com
    • 127.0.0.1 extensions.apple.com
    • 127.0.0.1 files.apple.com
    • 127.0.0.1 gspa21.ls.apple.com
    • 127.0.0.1 gsx-it.apple.com
    • 127.0.0.1 gsx.apple.com
    • 127.0.0.1 gsxit.apple.com
    • 127.0.0.1 guide.apple.com
    • 127.0.0.1 help.apple.com
    • 127.0.0.1 hrweb.apple.com
    • 127.0.0.1 iad.apple.com
    • 127.0.0.1 iadworkbench.apple.com
    • 127.0.0.1 id.apple.com
    • 127.0.0.1 identity.apple.com
    • 127.0.0.1 iforgot.apple.com
    • 127.0.0.1 images.apple.com
    • 127.0.0.1 index.apple.com
    • 127.0.0.1 init.apple.com
    • 127.0.0.1 investor.apple.com
    • 127.0.0.1 iphone.apple.com
    • 127.0.0.1 itunes.apple.com
    • 127.0.0.1 itunespartner.apple.com
    • 127.0.0.1 jobs.apple.com
    • 127.0.0.1 k.apple.com
    • 127.0.0.1 lists.apple.com
    • 127.0.0.1 locate.apple.com
    • 127.0.0.1 macos.apple.com
    • 127.0.0.1 manuals.info.apple.com
    • 127.0.0.1 manuals01.info.apple.com
    • 127.0.0.1 manuals02.info.apple.com
    • 127.0.0.1 manuals03.info.apple.com
    • 127.0.0.1 manuals04.info.apple.com
    • 127.0.0.1 maps.apple.com
    • 127.0.0.1 mapsconnect.apple.com
    • 127.0.0.1 meetingroom.apple.com
    • 127.0.0.1 mfi.apple.com
    • 127.0.0.1 mobile.apple.com
    • 127.0.0.1 mobileaccess.apple.com
    • 127.0.0.1 movies.apple.com
    • 127.0.0.1 movietrailers.apple.com
    • 127.0.0.1 myaccess-it.apple.com
    • 127.0.0.1 myaccess.apple.com
    • 127.0.0.1 mynews.apple.com
    • 127.0.0.1 mystore.apple.com
    • 127.0.0.1 news.apple.com
    • 127.0.0.1 nr.apple.com
    • 127.0.0.1 opensource.apple.com
    • 127.0.0.1 podcastsconnect.apple.com
    • 127.0.0.1 portal.apple.com
    • 127.0.0.1 quicktime.apple.com
    • 127.0.0.1 radar.apple.com
    • 127.0.0.1 register.apple.com
    • 127.0.0.1 relay.apple.com
    • 127.0.0.1 relay1.apple.com
    • 127.0.0.1 relay11.apple.com
    • 127.0.0.1 relay12.apple.com
    • 127.0.0.1 relay13.apple.com
    • 127.0.0.1 relay14.apple.com
    • 127.0.0.1 relay15.apple.com
    • 127.0.0.1 relay2.apple.com
    • 127.0.0.1 relay3.apple.com
    • 127.0.0.1 relay4.apple.com
    • 127.0.0.1 relay5.apple.com
    • 127.0.0.1 remoteadvisor.apple.com
    • 127.0.0.1 remoteadvisor1.apple.com
    • 127.0.0.1 remoteadvisor2.apple.com
    • 127.0.0.1 reportaproblem.apple.com
    • 127.0.0.1 s.apple.com
    • 127.0.0.1 safari-extensions.apple.com
    • 127.0.0.1 sales.apple.com
    • 127.0.0.1 salesresources.apple.com
    • 127.0.0.1 school.apple.com
    • 127.0.0.1 selfsolve.apple.com
    • 127.0.0.1 servers.apple.com
    • 127.0.0.1 service.apple.com
    • 127.0.0.1 sift.apple.com
    • 127.0.0.1 signin.apple.com
    • 127.0.0.1 signin.info.apple.com
    • 127.0.0.1 source.apple.com
    • 127.0.0.1 ssl.apple.com
    • 127.0.0.1 sso.apple.com
    • 127.0.0.1 store.apple.com
    • 127.0.0.1 support.apple.com
    • 127.0.0.1 support01.apple.com
    • 127.0.0.1 support02.apple.com
    • 127.0.0.1 support03.apple.com
    • 127.0.0.1 support04.apple.com
    • 127.0.0.1 support05.apple.com
    • 127.0.0.1 supportprofile.apple.com
    • 127.0.0.1 supporttest.apple.com
    • 127.0.0.1 survey.apple.com
    • 127.0.0.1 survey2.apple.com
    • 127.0.0.1 swdlp.apple.com
    • 127.0.0.1 time.apple.com
    • 127.0.0.1 time1.apple.com
    • 127.0.0.1 time2.apple.com
    • 127.0.0.1 time3.apple.com
    • 127.0.0.1 time4.apple.com
    • 127.0.0.1 time5.apple.com
    • 127.0.0.1 tips.apple.com
    • 127.0.0.1 trailers.apple.com
    • 127.0.0.1 training.apple.com
    • 127.0.0.1 trainingevents.apple.com
    • 127.0.0.1 uptodate.apple.com
    • 127.0.0.1 volume.apple.com
    • 127.0.0.1 war.apple.com
    • 127.0.0.1 www1.apple.com
    • 127.0.0.1 wwwtest.apple.com
    • 127.0.0.1 xml.apple.com
    • 127.0.0.1 xp.apple.com
    • 127.0.0.1 xp2.apple.com
    • 127.0.0.1 virustotal.com
    • 127.0.0.1 www.virustotal.com

  SOLUTION

Minimum scan engine: 9.850
First VSAPI Pattern File: 13.532.06
First VSAPI Pattern Release Date: 14 de июля de 2017
VSAPI OPR PATTERN-VERSION: 13.533.00
VSAPI OPR PATTERN DATE: 15 de июля de 2017

Step 1

Explorar el equipo con su producto de Trend Micro para eliminar los archivos detectados como OSX_DOKSPY.B En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.

Step 2

Eliminar estas cadenas que el malware/grayware/spyware ha añadido al archivo HOSTS

[ learnMore ]
    • 127.0.0.1 localhost
    • 255.255.255.255 broadcasthost
    • ::1             localhost
    • 127.0.0.1 metrics.apple.com
    • 127.0.0.1 ocsp.apple.com
    • 127.0.0.1 su.itunes.apple.com
    • 127.0.0.1 ax.su.itunes.apple.com
    • 127.0.0.1 swscan.apple.com
    • 127.0.0.1 swcdn.apple.com
    • 127.0.0.1 swdist.apple.com
    • 127.0.0.1 a1.phobos.apple.com
    • 127.0.0.1 a101.phobos.apple.com
    • 127.0.0.1 a102.phobos.apple.com
    • 127.0.0.1 a103.phobos.apple.com
    • 127.0.0.1 a104.phobos.apple.com
    • 127.0.0.1 a105.phobos.apple.com
    • 127.0.0.1 a11.phobos.apple.com
    • 127.0.0.1 a12.phobos.apple.com
    • 127.0.0.1 a13.phobos.apple.com
    • 127.0.0.1 a14.phobos.apple.com
    • 127.0.0.1 a15.phobos.apple.com
    • 127.0.0.1 access.apple.com
    • 127.0.0.1 advertising.apple.com
    • 127.0.0.1 albert.apple.com
    • 127.0.0.1 ali.apple.com
    • 127.0.0.1 ams.apple.com
    • 127.0.0.1 apple.apple.com
    • 127.0.0.1 apple.com
    • 127.0.0.1 appleconnect.apple.com
    • 127.0.0.1 appleid-it.apple.com
    • 127.0.0.1 appleid.apple.com
    • 127.0.0.1 appleseed.apple.com
    • 127.0.0.1 appleseed3.apple.com
    • 127.0.0.1 appleseedtest.apple.com
    • 127.0.0.1 aps.info.apple.com
    • 127.0.0.1 ara.apple.com
    • 127.0.0.1 arait.apple.com
    • 127.0.0.1 asia.apple.com
    • 127.0.0.1 asw.apple.com
    • 127.0.0.1 atlaslms.apple.com
    • 127.0.0.1 av.apple.com
    • 127.0.0.1 benefits.apple.com
    • 127.0.0.1 beta.apple.com
    • 127.0.0.1 bugreport.apple.com
    • 127.0.0.1 bugreporter.apple.com
    • 127.0.0.1 c.apple.com
    • 127.0.0.1 calendar.apple.com
    • 127.0.0.1 certifications-test.apple.com
    • 127.0.0.1 certifications.apple.com
    • 127.0.0.1 certifications2.apple.com
    • 127.0.0.1 checkcoverage.apple.com
    • 127.0.0.1 checkrepair.apple.com
    • 127.0.0.1 concierge-mobile.apple.com
    • 127.0.0.1 concierge.apple.com
    • 127.0.0.1 consultants.apple.com
    • 127.0.0.1 cooljobs.apple.com
    • 127.0.0.1 deimos.apple.com
    • 127.0.0.1 deimos2.apple.com
    • 127.0.0.1 deimos3.apple.com
    • 127.0.0.1 deploy.apple.com
    • 127.0.0.1 developer.apple.com
    • 127.0.0.1 developer2.apple.com
    • 127.0.0.1 developertest.apple.com
    • 127.0.0.1 devforums.apple.com
    • 127.0.0.1 devimages.apple.com
    • 127.0.0.1 diagnostics.apple.com
    • 127.0.0.1 discussions.apple.com
    • 127.0.0.1 documentation.apple.com
    • 127.0.0.1 downloads.apple.com
    • 127.0.0.1 ecommerce.apple.com
    • 127.0.0.1 employment.apple.com
    • 127.0.0.1 enterprise.apple.com
    • 127.0.0.1 ep.sap.apple.com
    • 127.0.0.1 erp.apple.com
    • 127.0.0.1 esp-test.apple.com
    • 127.0.0.1 esp.apple.com
    • 127.0.0.1 euro.apple.com
    • 127.0.0.1 events.apple.com
    • 127.0.0.1 ext.apple.com
    • 127.0.0.1 ext1.apple.com
    • 127.0.0.1 extensions.apple.com
    • 127.0.0.1 files.apple.com
    • 127.0.0.1 gspa21.ls.apple.com
    • 127.0.0.1 gsx-it.apple.com
    • 127.0.0.1 gsx.apple.com
    • 127.0.0.1 gsxit.apple.com
    • 127.0.0.1 guide.apple.com
    • 127.0.0.1 help.apple.com
    • 127.0.0.1 hrweb.apple.com
    • 127.0.0.1 iad.apple.com
    • 127.0.0.1 iadworkbench.apple.com
    • 127.0.0.1 id.apple.com
    • 127.0.0.1 identity.apple.com
    • 127.0.0.1 iforgot.apple.com
    • 127.0.0.1 images.apple.com
    • 127.0.0.1 index.apple.com
    • 127.0.0.1 init.apple.com
    • 127.0.0.1 investor.apple.com
    • 127.0.0.1 iphone.apple.com
    • 127.0.0.1 itunes.apple.com
    • 127.0.0.1 itunespartner.apple.com
    • 127.0.0.1 jobs.apple.com
    • 127.0.0.1 k.apple.com
    • 127.0.0.1 lists.apple.com
    • 127.0.0.1 locate.apple.com
    • 127.0.0.1 macos.apple.com
    • 127.0.0.1 manuals.info.apple.com
    • 127.0.0.1 manuals01.info.apple.com
    • 127.0.0.1 manuals02.info.apple.com
    • 127.0.0.1 manuals03.info.apple.com
    • 127.0.0.1 manuals04.info.apple.com
    • 127.0.0.1 maps.apple.com
    • 127.0.0.1 mapsconnect.apple.com
    • 127.0.0.1 meetingroom.apple.com
    • 127.0.0.1 mfi.apple.com
    • 127.0.0.1 mobile.apple.com
    • 127.0.0.1 mobileaccess.apple.com
    • 127.0.0.1 movies.apple.com
    • 127.0.0.1 movietrailers.apple.com
    • 127.0.0.1 myaccess-it.apple.com
    • 127.0.0.1 myaccess.apple.com
    • 127.0.0.1 mynews.apple.com
    • 127.0.0.1 mystore.apple.com
    • 127.0.0.1 news.apple.com
    • 127.0.0.1 nr.apple.com
    • 127.0.0.1 opensource.apple.com
    • 127.0.0.1 podcastsconnect.apple.com
    • 127.0.0.1 portal.apple.com
    • 127.0.0.1 quicktime.apple.com
    • 127.0.0.1 radar.apple.com
    • 127.0.0.1 register.apple.com
    • 127.0.0.1 relay.apple.com
    • 127.0.0.1 relay1.apple.com
    • 127.0.0.1 relay11.apple.com
    • 127.0.0.1 relay12.apple.com
    • 127.0.0.1 relay13.apple.com
    • 127.0.0.1 relay14.apple.com
    • 127.0.0.1 relay15.apple.com
    • 127.0.0.1 relay2.apple.com
    • 127.0.0.1 relay3.apple.com
    • 127.0.0.1 relay4.apple.com
    • 127.0.0.1 relay5.apple.com
    • 127.0.0.1 remoteadvisor.apple.com
    • 127.0.0.1 remoteadvisor1.apple.com
    • 127.0.0.1 remoteadvisor2.apple.com
    • 127.0.0.1 reportaproblem.apple.com
    • 127.0.0.1 s.apple.com
    • 127.0.0.1 safari-extensions.apple.com
    • 127.0.0.1 sales.apple.com
    • 127.0.0.1 salesresources.apple.com
    • 127.0.0.1 school.apple.com
    • 127.0.0.1 selfsolve.apple.com
    • 127.0.0.1 servers.apple.com
    • 127.0.0.1 service.apple.com
    • 127.0.0.1 sift.apple.com
    • 127.0.0.1 signin.apple.com
    • 127.0.0.1 signin.info.apple.com
    • 127.0.0.1 source.apple.com
    • 127.0.0.1 ssl.apple.com
    • 127.0.0.1 sso.apple.com
    • 127.0.0.1 store.apple.com
    • 127.0.0.1 support.apple.com
    • 127.0.0.1 support01.apple.com
    • 127.0.0.1 support02.apple.com
    • 127.0.0.1 support03.apple.com
    • 127.0.0.1 support04.apple.com
    • 127.0.0.1 support05.apple.com
    • 127.0.0.1 supportprofile.apple.com
    • 127.0.0.1 supporttest.apple.com
    • 127.0.0.1 survey.apple.com
    • 127.0.0.1 survey2.apple.com
    • 127.0.0.1 swdlp.apple.com
    • 127.0.0.1 time.apple.com
    • 127.0.0.1 time1.apple.com
    • 127.0.0.1 time2.apple.com
    • 127.0.0.1 time3.apple.com
    • 127.0.0.1 time4.apple.com
    • 127.0.0.1 time5.apple.com
    • 127.0.0.1 tips.apple.com
    • 127.0.0.1 trailers.apple.com
    • 127.0.0.1 training.apple.com
    • 127.0.0.1 trainingevents.apple.com
    • 127.0.0.1 uptodate.apple.com
    • 127.0.0.1 volume.apple.com
    • 127.0.0.1 war.apple.com
    • 127.0.0.1 www1.apple.com
    • 127.0.0.1 wwwtest.apple.com
    • 127.0.0.1 xml.apple.com
    • 127.0.0.1 xp.apple.com
    • 127.0.0.1 xp2.apple.com
    • 127.0.0.1 virustotal.com
    • 127.0.0.1 www.virustotal.com


Did this description help? Tell us how we did.