#HANYNET ICEFLOOR INDEX MAC OS X#

Similar to OSX/Crisis.B, this binary is obfuscated using MPress packer. Following is a screenshot of the resolved symbols hash of the dropper in IDA: OSX/Crisis.C - screenshot of the resolved symbols hash of the dropper in IDA When the dropper runs successfully, it hides the following files in the userвЂ™s home directory (in the Library/Preferences folder), inside a fake application bundle called OvzD7xFr.app: 1 backdoor: 8oTHYMCj.XIl (32-bit) 1 configuration file: ok20utla.3-B 2 kernel extentions: Lft2iRjk.7qa (32-bit) and 3ZPYmgGV.TOA (64-bit) 1 scripting addition: EDr5dvW8.p_w (FAT) 1 XPC service: GARteYof._Fk (FAT) 1 TIFF image, a System Preferences icon, ripped of Linkinus preferences panel: q45tyh Then it executes the backdoor and finishes the installation by creating a LaunchAgent file,. This might be a 64-bit bug in the malware. While it uses a different way to resolve system symbols, it crashes on OS X Mountain Lion or OS X Mavericks (segmentation fault). For this reason, an incautious researcher using a debugger could get infected without even noticing it. The original entry point EIP points to this code segment before reaching the almost empty _main function of the program. The dropper executes an unusual segment: _INITSTUB. However, Hacking Team has updated some of the dropper code and the backdoor configuration file format.

#HANYNET ICEFLOOR INDEX MAC OS X#

Could it be related to Pope Francis? Like the previous variants, OSX/Crisis.C is delivered through a dropper that installs silently, without requiring a password, and works on Mac OS X 10.5, 10.6, and 10.7. We currently do not have information about the origin of the file on VirusTotal, named вЂњFrantisek,вЂќ but it is an Eastern European first name meaning Francis. New OSX/Crisis Variant Invokes Pope Francis Posted on January 20th, 2014 by Arnaud Abbati A new sample of OSX/Crisis, the too popular Da Vinci rootkit from Hacking Team, reached our Malware Lab during the weekend.

Hanynet icefloor index