arrow_back
search
close

OSX_MOKES.A

September 12, 2016
 Analysis by: Nikko Tamana
 ALIASES:

MacOS:Ekoms-A [Trj] (Avast), OSX/Mokes.A (AVG), OSX/Mokes.odci (Avira), Backdoor.MAC.Mokes.A (BitDefender), OSX/Mokes.A (NOD32), Backdoor.MAC.Mokes.A (F-Secure), HEUR:Backdoor.OSX.Mokes.a (Kaspersky), OSX/Mokes-A (Sophos), Backdoor.Mokes (Symantec)

 PLATFORM:

Mac OS X

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Downloaded from the Internet, Dropped by other malware


This backdoor enables the attacker to steal a range of information, including screenshots, audio, and keylogs. It can also execute commands and communicate using encrypted data.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

  TECHNICAL DETAILS

File Size:

14,371,256 bytes

File Type:

Mach-O

Memory Resident:

Yes

Initial Samples Received Date:

08 Sep 2016

Payload:

Connects to URLs/IPs, Compromises system security

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This Backdoor drops the following files:

  • /Users/{Username}/Library/LaunchAgents/{Dropped Copy filename}.plist

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

  • Record Audio every 30 seconds
  • Monitor Removable Drives
  • Take screenshots and images from installed camera
  • Search and Download MS Office documents (doc, docx, xls, xlsx)

It connects to the following URL(s) to send and receive commands from a remote malicious user:

  • http://{BLOCKED}.{BLOCKED}.241.141/v1
  • http://{BLOCKED}ck12and67.com/v1
  • http://{BLOCKED}rcameand33212.com

Dropping Routine

This Backdoor drops the following file, into which it saves gathered information:

  • $TMPDIR/ss0-{Date}-{Time}-{ms}.sst (Captured Screenshots)
  • $TMPDIR/aa0-{Date}-{Time}-{ms}.aat (Captured Audio, WAV)
  • $TMPDIR/kk0-{Date}-{Time}-{ms}.kkt (Keylogs)
  • $TMPDIR/dd0-{Date}-{Time}-{ms}.ddt (Arbitrary Data)

NOTES:

This backdoor drops copies of itself in the first available file path in the following order:

$HOME/Library/App Store/storeuserd
$HOME/Library/com.apple.spotlight/SpotlightHelper
$HOME/Library/Dock/com.apple.dock.cache
$HOME/Library/Skype/SkypeHelper
$HOME/Library/Dropbox/DropboxCache
$HOME/Library/Google/Chrome/nacld
$HOME/Library/Firefox/Profiles/profiled

This backdoor uses the following User Agent:

  • Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A

This backdoor uses AES-256-CBC encryption to communicate with the malware's command and control server and hide its activities.

  SOLUTION

Minimum Scan Engine:

9.800

FIRST VSAPI PATTERN FILE:

12.764.08

FIRST VSAPI PATTERN DATE:

08 Sep 2016

VSAPI OPR PATTERN File:

12.765.00

VSAPI OPR PATTERN Date:

09 Sep 2016

NOTES:

Step 1

Terminate the malware process. To terminate the malware process, open a Terminal window and perform the following: Enter the following command:

ps -A
In the Terminal window, search for a line similar to the following:
{number} ?? {time} $HOME/Library/App Store/storeuserd
{number} ?? {time} $HOME/Library/com.apple.spotlight/SpotlightHelper
{number} ?? {time} $HOME/Library/Dock/com.apple.dock.cache
{number} ?? {time} $HOME/Library/Skype/SkypeHelper
{number} ?? {time} $HOME/Library/Dropbox/DropboxCache
{number} ?? {time} $HOME/Library/Google/Chrome/nacld
{number} ?? {time} $HOME/Library/Firefox/Profiles/profiled

Take note of the number since the number is the malware process ID (PID). For each malware process ID, enter the following command: kill {malware PID}

Step 2

Deleting the Malware Files. To delete the malware files, open a Terminal window and type the following commands:

rm $TMPDIR/ss0-{Date}-{Time}-{ms}.sst (Captured Screenshots)
rm $TMPDIR/aa0-{Date}-{Time}-{ms}.aat (Captured Audio, WAV)
rm $TMPDIR/kk0-{Date}-{Time}-{ms}.kkt (Keylogs)
rm $TMPDIR/dd0-{Date}-{Time}-{ms}.ddt (Arbitrary Data)
rm /Users/{Username}/Library/LaunchAgents/{Dropped Copy filename}.plist

Step 3

Scan your computer with your Trend Micro product to delete files detected as OSX_MOKES.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

To open a Terminal window, double-click Applications > Terminal in Finder. To close the Terminal application, press ? (Command) + Q. Note that not all files and folders are installed on your computer during this malware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files or folders, please proceed to the next step.


Did this description help? Tell us how we did.