Trojan.MacOS.APPLEJEUS.YEBBW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It attempts to access certain websites. However, the websites are inaccessible as of this writing.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• /Library/Application Support/Ants2WhaleHelper -> drops malicious file
• /Library/LaunchDaemons/com.ants2whale.product.plist

Download Routine

This Trojan accesses the following websites to download files:

• https://www.{BLOCKED}ica.com/wo-rss.php -> connects to this URL to download its payload

Other Details

Based on analysis of the codes, it has the following capabilities:

• Copy the decrypted payload into memory and execute the payload
• If failed to insert payload into memory, saves downloaded to /var/tmp/fiexpl
• It will repeat this routine every minute

It attempts to access certain websites. However, the websites are inaccessible as of this writing.

It does the following:

• This file is usually included in a malicious pkg file that has a postinstall script. Having this file installed in the system gives an indication of a malware present in system.
• This file itself was seen only to be bystander application that is installed