Monday, 30 July 2012
Apple Mac Trojan named OSX/Crisis.
Discovered by Intego.
Intego is a Mac security software company founded in 1997.
![[Image: HB1ca.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_t8i0WdG6d823y-iOFyjhN84lFGsPoqgRNLTT1d-_dEfdDqJOvx46a31xN4JZsLFiT3XCa8KExqKtN3w_lULw=s0-d)
They create backup, antivirus, antispam, data protection software, firewall for MAC OS X.
Now lets get back to our discussion
OSX/Crisis:
This threat is a dropper which creates a backdoor when it's run.
It installs silently, without requiring a password only in OSX 10.6,10.7 and Snow Leopard and Lion.
If the dropper runs on a system with Admin permissions it will drop a rootkit to hide itself.
With or Without Admin permissions this folder is created in the infected user's home:
~/Library/ScriptingAdditions/appleHID
only with Admin permissions,
/System/Library/Frameworks/Foundation.framework/XPCService
A new folder will be created.
It uses low level system calls to hide its activities
Image has been scaled down 20% (500x590). Click this bar to view original image (620x731). Click image to open in new window.
![[Image: jWTMn.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_v85_KqPqNSzmbCIc7khzCD421ioES_ohy_5UWkFtsZamIzlLjNyaSxhl8r5_7syr6GmBMZiSl3lV5wpKrdiQ=s0-d)
Image has been scaled down 20% (500x428). Click this bar to view original image (620x530). Click image to open in new window.
![[Image: ajycx.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uFJPLAp-ln_m90-rNHADiVJgfSHDcdPPg3QNnUDUoE-NVVENUC3lOpbO5IVKcw88TgJLBwi6UgNATq_rFQgvs=s0-d)
Image has been scaled down 20% (500x428). Click this bar to view original image (620x530). Click image to open in new window.
![[Image: TROpT.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vWTNUPD_h_Qx3vcRsLgl1n6hX9rZMR9720Dh_9GufdLjzXFbEQyq6Vg7Xqkx8L60QM3gYuVgdhGkCws0m5PFw=s0-d)
Intego suggest to use VirusBarrier X6 need to update to get protected from OSX/Crisis.
