Analysis by: Noel Anthony Llimos
ALIASES:

OSX/Lazarus.A (ESET-NOD32)

 PLATFORM:

Mac OS X

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan Spy

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

Infection Channel: Downloaded from the Internet, Dropped by other malware

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It arrives as a component bundled with malware/grayware packages.

It connects to a website to send and receive information.

  TECHNICAL DETAILS

File Size: 15,020,544 bytes
File Type: DMG
Memory Resident: Yes
Initial Samples Received Date: 03 Sep 2018
Payload: Connects to URLs/IPs, Downloads files

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It arrives as a component bundled with malware/grayware packages.

Backdoor Routine

This Trojan Spy connects to the following websites to send and receive information:

  • https://www.{BLOCKED}lc.com/checkupdate.php

Download Routine

This Trojan Spy saves the files it downloads using the following names:

  • /var/zdiffsec

Information Theft

This Trojan Spy gathers the following data:

  • List of Processes
  • Host Name
  • OS Type
  • OS Version
  • System Architecture
  • OS Kernel Type and Information

Other Details

This Trojan Spy does the following:

  • It installs the following file for its auto-start mechanism:
    • /Library/LaunchDaemons/com.celastradepro.plist
  • Upon execution it will install the following bundled application:
    • /Applications/CelastradePro.app
    • Which contains the following Mach-O executables:
      • CelasTradePro – GUI app of the CelasTradePro app
      • Updater – main malware responsible for data exfiltration and downloading routine.(detected as OSX_Lazarus.MANP)

  SOLUTION

Minimum Scan Engine: 9.850
FIRST VSAPI PATTERN FILE: 14.482.05
FIRST VSAPI PATTERN DATE: 03 Sep 2018
VSAPI OPR PATTERN File: 14.483.00
VSAPI OPR PATTERN Date: 04 Sep 2018

Scan your computer with your Trend Micro product to delete files detected as OSX_APPLEJEUS.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:

NOTES:

Cleanup

  1. Click on the Finder icon in the Dock.
  2. Choose Applications from the side menu of the window that appears.
  3. In the Applications folder, select the Utilities folder and open it.
  4. Double-click on the Activity Monitor icon to launch it.
  5. Select the following processes and quit these processes: Updater and CelasTradePro.app
  6. Click on the Finder icon in the Dock.
  7. On the upper Taskbar, select go Computer.
  8. Select your {Computer} Applications
  9. Right-Click the CelasTradePro app and select Move to Trash.
  10. Select {Computer} Library LaunchDaemons.
  11. Right-click the com.celastradepro.plist and select Move to Trash.
*{Computer} is the user’s computer name


Did this description help? Tell us how we did.