- Threat Encyclopedia
- Malware
- OSX_SLORDU.A
OSX.Slordu (Symantec), Backdoor.OSX.Belfibod.a (Kaspersky), OSX/Slordu-A (Sophos), OSX/Stealer.B (AVG), OSX/XSLCmd.A (ESET)
Mac OS X
Downloaded from the Internet, Dropped by other malware
This malware variant is designed to compromise Apple OS X systems. It drops files for its keylogging routine in order to steal information from the affected system.
To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It executes commands from a remote malicious user, effectively compromising the affected system.
It logs a user's keystrokes to steal information.
It deletes the initially executed copy of itself.
345,360 bytes
Mach-O
Yes
08 Sep 2014
Compromises system security, Drops files, Steals information
Arrival Details
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This backdoor drops the following copies of itself into the affected system:
It drops the following file(s)/component(s):
It creates the following folders:
It terminates the execution of the copy it initially executed and executes the copy it drops instead.
Autostart Technique
This backdoor drops the following files:
Backdoor Routine
This backdoor executes the following commands from a remote malicious user:
It connects to the following URL(s) to send and receive commands from a remote malicious user:
Dropping Routine
This backdoor drops the following file(s), which it uses for its keylogging routine:
Information Theft
This backdoor logs a user's keystrokes to steal information.
Other Details
This backdoor deletes the initially executed copy of itself
9.700
11.136.07
09 Sep 2014
11.137.00
09 Sep 2014
NOTES:
Step 1
Terminate the malware process. To terminate the malware process, open a Terminal window and perform the following:
Enter the following command:
In the Terminal window, search for a line similar to the following:
Take note of the number since the number is the malware process ID (PID). For each malware process ID, enter the following command:
Step 2
Delete the Malware Directories. To delete the malware directories, open a Terminal window and type the following commands:
Step 3
Deleting the Malware Files. To delete the malware files, open a Terminal window and type the following commands:
Step 4
Scan your computer with your Trend Micro product to delete files detected as OSX_SLORDU.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Note that not all files and folders are installed on your computer during this malware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files or folders, please proceed to the next step.