OSX_REVIR.A

This Mac malware disguises itself as a harmless document by dropping and executing a non-malicious .PDF file onto the affected system.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan connects to a certain website to download and execute a malicious file detected by Trend Micro as OSX_IMULER.A.

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}od.ru/cdmax

Trend Micro detects the dowloaded file as:

• OSX_IMULER.A

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

NOTES:

This Trojan disguises itself as a harmless document by dropping and executing a non-malicious PDF. It creates a downloader component in the following location:

• /tmp/host

The downloaded file is then saved in:

• /tmp/updtdata