Monday, 30 July 2012
Apple Mac Trojan named OSX/Crisis.
Discovered by Intego.
Intego is a Mac security software company founded in 1997.
![[Image: HB1ca.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uVhX5aoqRBfOhQyllc9Cguc1I2bznEPdyN9R04fVMAmqeMtOWPNAHml_maYDAmRFD-_IxtPnHYx6hWbl9Nqw=s0-d)
They create backup, antivirus, antispam, data protection software, firewall for MAC OS X.
Now lets get back to our discussion
OSX/Crisis:
This threat is a dropper which creates a backdoor when it's run.
It installs silently, without requiring a password only in OSX 10.6,10.7 and Snow Leopard and Lion.
If the dropper runs on a system with Admin permissions it will drop a rootkit to hide itself.
With or Without Admin permissions this folder is created in the infected user's home:
~/Library/ScriptingAdditions/appleHID
only with Admin permissions,
/System/Library/Frameworks/Foundation.framework/XPCService
A new folder will be created.
It uses low level system calls to hide its activities
Image has been scaled down 20% (500x590). Click this bar to view original image (620x731). Click image to open in new window.
![[Image: jWTMn.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sCCNfrxPOYCkig-2DSjJYYl1CUJgkotXCwP-SwfaP9_n8dOdGER30OfuPU_tayuFkVwEngA8g5FdZsNwnBXw=s0-d)
Image has been scaled down 20% (500x428). Click this bar to view original image (620x530). Click image to open in new window.
![[Image: ajycx.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tNk7R5OBaPibESepsHZQOUnYGRSveIJsJYekOnpT3_apOuXNG9YRXlDYGg0RYePN3pEa6BC19xw1wo_avMUHs=s0-d)
Image has been scaled down 20% (500x428). Click this bar to view original image (620x530). Click image to open in new window.
![[Image: TROpT.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sSwJ6EWibo71XMmHIwo2bMKOxQplX3W2QPIjNvvgbI3oEEtrz4E3Zv3GKOlKRzx5PhfuKd7AQBLXFT60I8jis=s0-d)
Intego suggest to use VirusBarrier X6 need to update to get protected from OSX/Crisis.
