Its only payload was to display a dialogue box saying “Yep this is an application. (So what is your iTunes playing right now?)” At the same time it launched iTunes and tried to play a 4-second MP3 audio clip of “wild laughter” (apparently a man laughing).

Once installed as a Startup Item it was intended to run as root without the need to invoke sudo (a utility mostly found in Unix-like or Unix-derived operating systems that allows a user account to run system programs at a higher privilege level).
By version 2.3.8, the version usually reported, it was installing a variety of backdoor and spyware functions, stealing a range of configuration and application information, and also included password-cracking and other decryption functionality.
Author DimBulb is credited “for inspiration” by the author of the osxrk rootkit, from September 2004.

########################################################################
# opener 2.3.5a - a startup script to turn on services and gather user info & hashes for Mac OS X
########################################################################
# Originally written by DimBulb
# Additional code: hard-mac, JawnDoh!, Dr_Springfield, g@pple
# Additional ideas and advice: Zo, BSDOSX
# This script runs in bash (as is noted by the very first line of this script)
# To install this script you need admin access or
# physical access (boot from a CD or firewire/usb, ignore permissions on the internal drive) or
# write access to either /Library/StartupItems /System/Library/StartupItems or
# write access to any existing StartupItem (which you can then replace with this script) or
# write access to the rc, crontab, or periodic files (and have them run or install the script) or
# you could trick someone who has an admin account into installing it.
# It should go in /System/Library/StartupItems or /Library/StartupItems (when it is executed it
# will move itself to /System/Library/StartupItems)
# Since it is a StartupItem it will run as root - thus no "sudo" commands are needed. If you run
# it as any other user most of the commands will generate errors! (You could sudo ./opener)
# Save start time and date for performance testing

The malware required user interaction in order to spread, and used Spotlight to infect all the files it found on disk.

It modified the setting of launchd to make sure its code was executed at boot time, thus ensuring persistence (that is, it continued to load at every system reboot).

It attempted to spread by sending OBEX Push requests to other Bluetooth devices, though its spread was limited by the use of a time-limited library version, meaning that it could not spread after February 24, 2006. Inqtana.D significantly developed the attack in that it didn’t require any user interaction in order to install, and once installed the backdoor access was available through Ethernet or AirPort, not just Bluetooth.

This group is also closely related to the Zlob family, associated with similar malicious functionality on Windows platforms. This type of malware was found in great numbers in the wild. It is predominantly found as a DMG file containing an installation package named install.pkg.

It has been distributed using various schemes such as fake codecs, an approach commonly used by malware on other platforms. The ultimate purpose of this malware is to change DNS settings of an infected host, potentially enabling the attacker to alter Internet content accessed from an infected system. A script named preinstall, executed at the beginning of the installer process, performs these malicious actions. A set of shell commands is launched to write the script to disk and execute it. An interesting point relating to OSX/Jahlav is that this threat uses server side polymorphism to generate new copies of its binaries, probably in an effort to evade detection by intrusion detection systems and antivirus software. Script files are also obfuscated using various shell tools such as uuencode, sed, and tail to conceal, vary or reverse the order of the commands and hamper analysis.

ESET threat descriptions:

• OSX/TrojanDownloader.Jahlav.NAL
• OSX/TrojanDownloader.Jahlav.NAN
• OSX/TrojanDownloader.Jahlav.NAK
• OSX/TrojanDownloader.Jahlav.NAM

Related blogs:

• Macs & Malware
• Snow Leopard and Malware
• Mac Malware (again)

Most of the descriptive material applying to OSX/MacSweep also applies to iMunizator: in fact, some vendors flag iMunizator as OSX/MacSweep.B, and some sources reported an almost identical screen for both “products” saying “Get rid of compromising files now”, and claiming that the product was “3-in-1 Internet cleaner, System cleaner, and Performance optimizer for your MAC” The program flags a number of perfectly legitimate applications as privacy violations, malware, bad cookies, “compromising files” and so on , and anyone trying to remove them is told they need to buy the MacSweep software.

The “call to action” in this case was again a screen saying “Get rid of compromising files now”, and claiming that the product was “3-in-1 Internet cleaner, System cleaner, and Performance optimizer for your MAC”. Wouldn’t it be nice if you could get an application to clean the Internet?

The program flags a number of perfectly legitimate applications as “trash”, and any victim naive enough to try to remove them is told they need to buy the iMunizator software. Amusingly (in a black sort of way), iMunizator tries to tell you that the apps it flags may compromise the victim’s credit card.

It could also contact a command and control server on the Internet to receive additional commands. Functionally, it therefore closely resembles certain classic Windows mass-mailers as well as many bots. However, we have not seen any instance of Mac/Tored.AA in the wild.

In some variants, the information is sent back in an email with the subject Howdy, hence the name. Some variants were programmed as a bash script while other variants are programmed using AppleScript. We saw around a dozen different variants of the OSX/Hovdy script malware.

In order to get sensitive information it displays the following dialog box:

The trojan acquires data and commands from a remote computer or the Internet. It may also:

• run executable files
• execute shell commands
• shut down/restart the computer
• log off the current user
• send data to the printer
• open a specific URL address
• change the sound volume
• open the CD/DVD drive
• play sound/video
• open web page using user’s default browser
• watch the user’s screen content

ESET threat description:

• OSX/HellRTS.AA

This spyware masking itself as a market research utility was offered as part of the installation process for a number of screensavers. It also acted as a backdoor and could be controlled remotely.

ESET threat description:

• OSX/OpinionSpy

Related blogs:

• Mac Malware OSX/OpinionSpy
• OSX/OpinionSpy Revisited
• More on OSX/OpinionSpy

Boonana is  a trojan downloader (a Java applet) that executed an installer, which, in turn, modified system files so that an outside attacker did not need passwords in order to access the system. Moreover, the trojan periodically checked in with a Command-and-Control (C&C) server for updated instructions. There were also reports of the malware being spammed out through email.

When the potential victim runs the "video", a message is generated suggesting that the video can’t be watched without installing special software.

If the user falls for the trick, the Java applet runs on their Windows, OS X or Linux computer. For Windows systems, however, a registry entry is added, while for OS X files are copied to /Library/StartupItems and a script called OSX updates is created.

This is very much social engineering-focused malware: its initial attack is on the user, not on the platform, and it isn’t self-launching in the first instance. In other words, the malware requires user consent to be installed. While the intended functionality is similar to the notorious Koobface worm, the actual code in Boonana doesn’t resemble Koobface’s, which is why ESET hasn’t used that name as an identifier, though some vendors have done so.

Related blog:

• Boonana Threat Analysis

“Welcome to BlackHole RAT. Now this is the Beta Version, and there are funktions (sic). Have Fun;)“

The user interface also includes some German words such as Ablage and Bearbeiten, though the messages are in (more or less) English.

“…I am a Trojan Horse, so i have infected your Mac Computer. I know, most people think Macs can’t be infected, but look, you ARE Infected!”

According to comments in the code, there was intended to be a more stable version in due course.

So, Im a very new Virus, under Development, so there will be much more functions when im finished.

However, the darkComet RAT project was declared terminated in June 2012.

BlackHole’s abilities included the following:

• Execute shell commands remotely.
• Direct the user’s browser to its own choice of web page.
• Create a text file on the desktop.
• Perform shutdown, restart and sleep operations: in fact, it may put up a window from which the user can only escape by letting it reboot the machine as a demonstration of its capabilities.
• Pop up a fake Finder message asking the victim to enter the administrator password.

The name notwithstanding, there is no obvious connection between this Blackhole and the Black Hole exploit kit.

ESET threat description:

• OSX/Musminim

The infection was spread via poisoned search engine results on image searches. When a bad link was followed in a search, the user was presented with an alert that trojans or other threats have been detected on the system.

At the start of the attack, either a simple dialog box over the browser window or a fake Finder window is displayed. The malware was updated over time to present a user interface more like a native OS X application and less like a Windows application. Subsequent variants were also deployed that were capable of installing through a fake Finder window requiring the user to enter administrator credentials. If the victim clicked on the "Cancel" or "Remove All" buttons instead of closing the browser normally (or if necessary, with Force Quit), it was able to install the software anyway. It also took advantage of Safari’s default setting ‘Open “safe” files after downloading’ to download and open the malware automatically.

Once the malware was installed and launched, the victim was told that the software was an Unregistered Copy, and given the option of registering and paying for it.

Related blogs:

• MacDefender (now MacGuard) Can Install Without Credentials
• MacDefender: The sky is not falling…
• MacDefender undergoes a name change, MacShield

It may use known Java exploits to gain access to the victim’s system. The trojan contains an IP address to which it tries to connect over port 80 using TCP.

It may execute the following operations:

• download files from a remote computer and/or the Internet
• send files to a remote computer
• various file system operations
• execute shell commands
• send the list of files on specific drive to a remote computer

ESET threat description:

• OSX/Olyx

The malware presents a standard and professional looking installer screen to create a backdoor via a dynamic library called Preferences.dylib. Once installed, it uses RC4 encryption to communicate with a remote server, and transmit data such as the users MAC address, OS version, UUID, and more. The malware could also potentially be used to allow the malware author to inject code into the target Mac.

A later variant of OSX/Flashback included exploit code for CVE-2012-0507, a Java exploit also used by the Blackhole exploit kit. This meant that the trojan was able to infect computers without user interaction. Oracle released a Java update that addressed the problem, as did Apple, later on.

The malware collects information about the infected computer, its operating system, and system settings, and tries to send the information on to a remote machine. It receives data and instruction from a Command & Control server via HTTP. It quits immediately if Little Snitch is detected on the system and removes itself from the computer.

ESET recommends disabling Java in Safari and OS X, if it is not needed most of the time.

The trojan displays the following picture:

In September 2012, ESET released a comprehensive technical analysis of the Flashback threat.

ESET threat description:

• OSX/Flashback

Related blogs:

• New Apple OS X Malware: Fake Adobe Flash Installer
• Mac Flashback Trojan: If you use Java the time to patch your Mac is now
• Fighting the OSX/Flashback Hydra
• Flashback Wrap Up

The malicious application poses as a PDF file, and even displays a PDF embedded in its own body. This payload displays some politically contentious Chinese text while the app extracts a downloader that fetches and installs a backdoor Trojan (Imuler). The backdoor is intended to communicate with a C&C (Command and Control) server.

The most striking similarity between this and the techniques used by Windows malware is in the use of a phased infection process using several components. The PDF is not booby-trapped with some kind of 0-day threat, as is so often the case with targeted malware, but is simply a component of the malware, which must be executed before the PDF can be displayed. The Imuler Trojan acquires data and commands from a remote computer whose URL is embedded within it, or over the Internet using HTTP.

The malware can execute the following operations:

• capture screenshots
• send files to a remote computer
• send various information about the infected computer
• download files from a remote computer and/or the Internet
• run executable files
• extract ZIP archive

ESET threat descriptions:

• OSX/Imuler
• OSX/Revir

Related blogs:

• PDF Trojan Appears on Mac OS X
• OSX/Imuler updated: still a threat on Mac OS X

Devilrobber performs the following malicious activities:

• Opens ports and listens for C&C servers
• Steals GPU (Graphics Processing Unit) cycles to generate Bitcoins in order to defraud the Bitcoin service, and if it finds a Bitcoin wallet on the infected machine, steals that too
• Acts as spyware, forwarding usernames and passwords to a remote server
• Noses around looking for other stuff like the keychain file, bash history file, Safari history file, and takes and forwards screenshots
• It may also be looking for files that contain child abuse material

ESET threat description:

• OSX/DevilRobber

The malware is a version of the elderly Linux/Tsunami malware (also known as Kaiten), recompiled as a Mach-O binary to run under OS X. Of low risk, but apparently a work in progress: a second version shows some “improvements.”

First detected in 2002 for Linux-based systems, once installed, this backdoor Trojan intended to listen for instructions transmitted over IRC. Its command set is focused on various attacks, but its ability to execute shell commands has the potential for many other types of actions. The list of accepted commands is taken from the comment block in the Linux C source code.

In addition to enabling DDoS attacks, the backdoor can also enable a remote user to download files, such as additional malware or updates to the Tsunami code. The malware can also execute shell commands, giving it the capability to essentially take control of the affected machine.

ESET threat description:

• OSX/Tsunami

Related blog:

• Linux Tsunami hits OS X

The webserver would serve a platform-specific JAR (Java Archive) dropper based on the browser’s UserAgent String in order to infect Windows and OS X systems.

OSX/Lamadai.A has built-in features typical of a backdoor: namely the download and execution of an arbitrary file, uploading of local files to the operator’s Command-and-Control (C&C) server, and spawning of a command-line shell. It is the Mac OS X payload of a multi-platform attack exploiting the Java vulnerability (CVE-2011-3544) to infect its victims.

The OS X-specific dropper was also served to Linux clients. However, since the dropped payload is designed for OS X only, Linux clients will not be infected. OS X uses the Mach-O file format for its executable files. For OSX/Lamadai.A, the Mach-O executable was compiled for 64-bit only, which is unusual since Mach-O binaries normally contain both the 32-bit and 64-bit versions of the executable.

ESET threat description:

• OSX/Lamadai

Related blogs:

• OSX/Lamadai.A: The Mac Payload
• OS X Lamadai: Flashback isn’t the only Mac malware threat

It can execute the following operations:

• send the list of files on specific drive to a remote computer
• download files from a remote computer and/or the Internet
• send files to a remote computer
• run executable files
• capture screenshots

It seems to have originated on 16th March 2012 or even a little earlier. Reports indicate a link between SabPab (or SabPub – vendor detection names vary) and APT attacks labeled Luckycat. There may even be a link with attacks on Tibetan activists. Later attacks have used Word documents exploiting the CVE-2009-0563 buffer overflow vulnerability in Microsoft Office. A later variant of this malware does not use Java exploit CVE-2012-0507, so Apple’s updates do not provide protection for this elderly Office vulnerability.

ESET threat description:

• OSX/Sabpab

Morcut hasn’t been seen in the wild to date: the initial samples were uploaded directly to the VirusTotal multi-scanning engine site. The malicious JAR file includes a Java class file misleadingly called WebEnhancer that checks the Java Virtual Machine (JVM) it is running under to see if the operating system is Windows or OS X. If the JVM is running under Windows, it installs a version of Win32/Swizzor; if it’s OS X, it installs OSX/Crisis.

Crisis is neither the first nor the only attempt at hardware-independent malware, but the significance of the fact that the attempt is being made should not be underestimated, even though there are more technically-interesting aspects to the whole malware package: in particular, the range of activity and data the malware is meant to monitor put it right in the spyware category. The sensitive data it can compromise includes IM transactions, location, keystrokes and mouse movement, contents of the clipboard, running processes, and an assortment of other device and environment information that is tracked.

Related blog:

• The Cloud for SMBs: 7 tips for safer cloud computing