|
|
We recently received a new sample of the Mac malware OSX/Puper.a. This file [MD5 Sum: 428143005E07E510302BA431FE0C28CC], which disguises itself as a Mac Cinema Installer, was recently mentioned in PC Magazine.
When the DMG file is executed on the Mac, it displays the following message:
As the execution continues, the malware gets installed on the machine with the root user’s credentials. Below is a screen shot of the malware after installation:
The file AdobeFlash in the screen above is the malicious script file. This file is obfuscated using Uuencode and looks like this before decoding:
And like this after decoding:
From the shot above we can see another set of obfuscated code after the schedule-task instructions. We can also see that the malware creates a scheduled job to run itself once every five hours, shown as below:
Decoding the rest of the script reveals the following:
From the screen above we see that the malware downloads the file generator.pl and executes it.
Although the number of malware for Macs still remains tiny when compared with the number of malware for Microsoft Windows, new variants of malware such as this remind us to be careful.
|
|
Nice blog Lokesh! apparently you expunged before Trend Micro
http://blog.trendmicro.com/mac-os-x-dns-changing-trojan-in-the-wild/
Very, very professionally described, guys.
1- DMG files are no executed, but opened. They are disk images.
2- The user must explicitly execute the installer. (Unless, of course, the authors of the malware have a method to have it executed automatically, which would really deserve headlines)
3- “as the execution progresses, the malware gets installed with the credentials of root, blah, blah, blah”. Of course, the user needs to supply a valid administrator password. But yes, it’s an irrelevant detail.
So, what would someone who doesn’t know Mac OS X well interpret this post? they would infer that once you open the DMG file you’re busted. Don’t you think?
As I said, an amazingly lame description.
Submit your own comments / message for this post