Trojan.MacOS.NUKESPED.YXBBS

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

No obstante, de este modo no se podrá acceder a los sitios mencionados.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra y ejecuta los archivos siguientes:

• This file is usually included in a malicious pkg file that has a postinstall script. This file contains the malicious payload of the pkg.

Técnica de inicio automático

Infiltra los archivos siguientes:

• /Library/UnionCrypto/unioncryptoupdater (drops malicious file)
• /Library/LaunchDaemons/vip.unioncrypto.plist
  • Note: “vip.unioncrypto.plist” runs “unioncryptoupdater” using the “RunAtLoad” to run the malicious file every time the system is booted. Unioncryptoupdater and vip.unioncrypto.plist are hidden files in the package file

Rutina de descarga

Accede a los siguientes sitios Web para descargar archivos:

• https://{BLOCKED}rypto.vip/update → payload

No obstante, de este modo no se podrá acceder a los sitios mencionados.

Otros detalles

Hace lo siguiente:

• Decrypts downloaded payload
• Tries to copy the decrypted payload into memory and execute the payload
• If failed to insert payload into memory, saves downloaded to /tmp/updater
• Will continuously try to repeat the routine every minute