Bibliothèque
Ma bibliothèque

+ Ajouter à la bibliothèque

Contacter-nous !
Support 24/24 | Rules regarding submitting

Nous téléphoner

0 825 300 230

Forum

Vos requêtes

  • Toutes : -
  • Non clôturées : -
  • Dernière : le -

Nous téléphoner

0 825 300 230

Profil

Mac.Trojan.VSearch.4

Added to the Dr.Web virus database: 2016-02-24

Virus description added:

SHA1 7e82a05a9854f979607b2f9427817bef4bca2dc1

A Trojan for OS X installed by Mac.Trojan.VSearch.2.

It includes the following components:


DemoUpdater.app
daemon_config.plist
install_updater.sh
preferences.plist
readme_upd.txt
st-up.sh
uninstall_updater.sh

During installation, the Trojan performs the following actions that are specified in the install_updater.sh script:

  1. Generates a random name of the Trojan and adds the “Upd” value to it (which is then referred to as the appName value).
  2. Records the appName value into the “/Library/Preferences/com.common.plist” file using the name_upd key.
  3. Creates the “/Library/Preferences/com.appName.preferences.plist” file.
  4. Records the following parameters into this file:
    • dist_channel_id
    • machine_id
    • click_id
    • domain
  5. An executable file is copied to /Library/appName.
  6. The Trojan’s executable file is launched using the launchctl load command.

At launching, the malicious program decrypts several parameters necessary for its operation. The Trojan then reads the /Library/Preferences/com.common.plist file in order to determine a location of a configuration file that contains additional parameters. Once the parameters are obtained, the Trojan generates the URL that looks as follows:

http://domain/pd/pi?id=machine_id&d=dist_channel_id&cl=click_id

In return, the malware program receives a link that is used to download a script. The script is then executed in the system.

The Trojan re-downloads and executes the script every day. Mac.Trojan.VSearch.4 can generate several addresses to download a payload. In total, Doctor Web specialists registered 406 possible variants.

This script is used to download Mac.Trojan.VSearch.7 from the server and launch it. In addition, applying this script, Mac.Trojan.VSearch.4 can set the Trovi server as a default search engine and download a search plug-in for Safari, Chrome, and Firefox. Dr. Web detects this plug-in as an unwanted application named Program.Mac.Unwanted.BrowserEnhancer.1.

News about the Trojan

Recommandations pour le traitement


macOS

Veuillez lancer le scan complet du système à l'aide de Dr.Web Antivirus pour macOS.

Version démo gratuite

Pour 1 mois (sans enregistrement) ou 3 mois (avec enregistrement et remise pour le renouvellement)

Télécharger Dr.Web sur le site

Par le numéro de série