New Mac Malware from Eset

Rusli

New Mac Malware from Eset Threat Center. Please take note.

 

OSX/Morcut

OSX/Agent.AA

OSX/Flashback.K

OSX/Getshell.B,

OSX/Getshell.A, OSX/Siggen.A,

OSX/MacKontrol.A

OSX/Siggen.A

OSX/Filecoder.B

OSX/Filecoder.A

OSX/Flashback.L

OSX/Lamadai.C

 

Check thru

 

http://go.eset.com/us/threat-center/threatsense-updates/page/1/?q=osx

 

Ikarus detects

 

• Exploit.OSX.Safari.a
• Worm.OSX.Inqtana.a
• Java.OSX.Inqtana
• Worm.OSX.Niqtana.a
• Virus.OSX.Macarena.a
• Trojan.Osx.Exploit.Launchd.B
• Trojan.Osx.Exploit.Launchd.A
• Trojan.OSX.Imunizator
• Virus.OSX.Leap.B
• Trojan.OSX.Loader.A
• Hoax.OSX.Mcsweeper.a
• Virus.OSX.Niqtana.D
• Virus.OSX.Macarena
• Worm.OSX.Inqtana
• Exploit.OSX.Safari
• Exploit.OSX.Launch
• Trojan.OSX.Dropper
• Trojan.OSX.Loader
• Hoax.OSX.Mcsweeper
• JS.OSX.Troj
• Trojan-Downloader.OSX.Jahlav
• Virus.OSX.RSPlug
• Virus.OSX.Weapox
• Backdoor.OSX.Lamzev
• Trojan.OSX.Jahlav
• Trojan.Osx.Exploit.Launchd
• Trojan-PWS.OSX.Corpref
• OSX.Trojan-PWS.Corpref
• MAC.OSX.Trojan.DNSChanger
• IM-Worm.OSX.Leap
• Worm.OSX.Niqtana
• Win32.Worm.Osx.Niqtana
• Trojan.Exploit.Osx.Launch
• Rootkit.OSX.Weapox
• Trojan.Osx.Weapox
• Suspect.OSX.iWorkS
• Backdoor.OSX.iWorm
• MAC.OSX.Trojan.Krowi
• Virus.OSX.Niqtana
• not-a-virus:FraudTool.OSX.iMunizator
• OSX.Worm.Tored
• Worm.OSX.Tored
• Email-Worm.OSX.Tored
• Exploit.OSX.Libtiff
• Exploit.OSX.Smid
• not-a-virus:Monitor.OSX.Keylogger
• Trojan.OSX.Gaslome
• not-a-virus:RiskTool.OSX.Baoba
• Trojan.OSX.HellRTS
• not-a-virus:NetTool.OSX.Mech
• Backdoor.OSX.Reshe
• not-a-virus:RemoteAdmin.OSX.Cowhand
• Trojan.OSX.Spynion
• Backdoor.OSX.Sunam
• Trojan.OSX.Inqtana
• MAC.OSX.Trojan.Boonana
• Trojan.OSX.Launchd
• MAC.OSX.Spyware.OpinionSpy
• Backdoor.OSX.BlackHol
• Hoax.OSX.Defma
• MAC.OSX.Trojan.FakeAlert.A
• MAC.OSX.Trojan.FakeAlert.B
• MAC.OSX.Trojan.FakeAlert.C
• Trojan-Downloader.OSX.FavDonw
• MAC.OSX.Trojan.FakeAlert
• MAC.OSX.Backdoor.BlackHol
• MAC.OSX.Trojan.FakeAlert.D
• MAC.OSX.Trojan.FakeAlert.F
• MAC.OSX.Trojan.FakeAlert.G
• MAC.OSX.Trojan.FakeAlert.E
• MAC.OSX.Trojan.FakeAlert.H
• Backdoor.OSX.Olyx
• MAC.OSX.AdWare.MacSweeper
• Backdoor.OSX.Imuler
• Trojan-Dropper.OSX.Revir
• Trojan-Downloader.OSX.Revir
• Trojan-Downloader.OSX.Flashfake
• Application.Osx.Cosmac
• MAC.OSX.Backdoor.Tsunami
• Trojan.OSX.Agent
• Backdoor.OSX.Miner
• Trojan.OSX.Miner
• MAC.OSX.Trojan.DevilRobber
• Application.Posx
• MAC.OSX.Trojan.FlashBack
• MAC.OSX.Trojan.FakeAlert.I
• MAC.OSX.Backdoor.Olyx
• OSX.Niqtana
• Hoax.OSX.MacKeeper
• MAC.OSX.Trojan.FakeAlert.J
• MAC.OSX.Trojan.Imuler
• MAC.OSX.Trojan.Lamadai
• Backdoor.OSX.MaControl
• not-a-virus:Monitor.OSX.LogKext
• not-a-virus:Monitor.OSX.SniPo
• OSX.Weapox
• OSX.Safari
• Backdoor.OSX.SabPub
• Backdoor.OSX.Flashback
• not-a-virus:Monitor.OSX.BackTrack
• Backdoor.OSX.Lasyr
• not-a-virus:Monitor.OSX.SpyMe
• MAC.OSX.Backdoor.Imuler
• MAC.OSX.Trojan.Revir
• Backdoor.OSX.GetShell
• Backdoor.OSX.Morcut
• Rootkit.OSX.Morcut
• Trojan.OSX.Morcut

 

garlangreeny

Nice list of threats here. Thanks for the post.

Rusli

There's more here is the new updates for Mac Malware.

 

dated from 7 Aug 2012 to 17 Oct 2012.

 

OSX/Agent.AB

OSX/HellRTS.AD

OSX/Rootkit.Rubilyn.A

OSX/Siggen.A

OSX/Revir.B

OSX/TrojanDownloader.Jahlav.NAJ

OSX/TrojanDownloader.Jahlav.NAJ

OSX/Imuler.D

OSX/Adware.MacDefender.A

OSX/Cyanide.A

OSX/Adware.MacDefender.O

OSX/Blackhole.C

OSX/HellRTS.AC

OSX/Macarena.A

OSX/DevilRobber.D

OSX/HellRTS.AB

OSX/OpinionSpy.D

OSX/Getshell.B

Win32/Qhost.OSX (I'm not that sure with this one.)

OSX/Getshell.B

OSX/Getshell.B

Win32/Qhost.OSX (same as the above.)

 

check here: - http://go.eset.com/us/threat-center/threatsense-updates/page/1/?q=osx

 

Some newer ones which Ikarus reported. ( I think kaspersky for mac is using the same virus signatures with Ikarus)

 

Backdoor.OSX.Wirenet

• MAC.OSX.Trojan.FinSpy
• Trojan.OSX.FakeCo
• MAC.OSX.Trojan.Agent
• MAC.OSX.Trojan.FakeAlert.K
• MAC.OSX.Trojan.FakeAlert.L
• MAC.OSX.Macarena
• Mac.OSX.Trojan.MacControl

check here:- http://www.ikarus.at/en/private/info-center/virus-lexicon/index.html?action=search&term=osx&what=name

 

Intego detect a new Mac malware called Jacksbot

 

http://www.intego.com/mac-security-blog/new-multiplatform-backdoor-jacksbot-discovered/

 

Janiashvili

Rusli, sincerely, why you're writing everything like this here???

Rusli

There are people from f-secure needs to know.

 

There are people in the forum needs to know about this too.

 

Janiashvili

I don't think people at f-secure don't know about this; and about forum, who reads this forum except one or two like us?

Rusli

Not onlly F-Secure staff need to know, there are people here need to be aware and know what is happening before they got hit by new Mac viruses.

 

At least they are confident how to tackle problems!

 

Rusli

last updates of known Mac Viruses.

 

Backdoor.OSX.Wirenet

• MAC.OSX.Trojan.FinSpy ( I think this is FinFisher trojan! )
• Trojan.OSX.FakeCo
• MAC.OSX.Trojan.Agent
• MAC.OSX.Trojan.FakeAlert.K
• MAC.OSX.Trojan.FakeAlert.L
• MAC.OSX.Macarena
• Mac.OSX.Trojan.MacControl
• MAC.OSX.Trojan.WeaponX
• MAC.OSX.HackTool.Rubilyn

http://www.ikarus.at/en/private/info-center/virus-lexicon/index.html?action=search&term=osx&what=name

 

http://go.eset.com/us/threat-center/threatsense-updates/search/?q=osx

 

http://macscan.securemac.com/spyware-list/

 

http://www.freedrweb.com/drweb+mac+light/

 

Rusli

 

Eset Threat Center:- Malware for OS X

 

OSX/MacKontrol.B

OSX/Morcut.B

OSX/Getshell.C

OSX/TrojanDownloader.Jahlav.NAO

OSX/Iservice.AE

OSX/Imuler.B

Win32/Kryptik.AOSX

OSX/Imuler.E

OSX/Agent.AB

OSX/HellRTS.AD

OSX/Rootkit.Rubilyn.A

OSX/Siggen.A

OSX/Revir.B (2), OSX/TrojanDownloader.Jahlav.NAJ

 

Detection  dated on Sept 27 2012 to Nov 24 2012.

http://go.eset.com/us/threat-center/threatsense-updates/page/1/?q=osx

 

Ikarus:-

 

http://www.ikarus.at/en/private/info-center/virus-lexicon/index.html?action=search&term=osx&what=name

 

Backdoor.OSX.SabPub

• Backdoor.OSX.Flashback
• not-a-virus:Monitor.OSX.BackTrack
• Backdoor.OSX.Lasyr
• not-a-virus:Monitor.OSX.SpyMe
• MAC.OSX.Backdoor.Imuler
• MAC.OSX.Trojan.Revir
• Backdoor.OSX.GetShell
• Backdoor.OSX.Morcut
• Rootkit.OSX.Morcut
• Trojan.OSX.Morcut
• Backdoor.OSX.Wirenet
• MAC.OSX.Trojan.FinSpy
• Trojan.OSX.FakeCo
• MAC.OSX.Trojan.Agent
• MAC.OSX.Trojan.FakeAlert.K
• MAC.OSX.Trojan.FakeAlert.L
• MAC.OSX.Macarena
• Mac.OSX.Trojan.MacControl
• MAC.OSX.Trojan.WeaponX
• MAC.OSX.HackTool.Rubilyn

ClamAV Search Database for OSX Malware

 

http://clamav-du.securesites.net/cgi-bin/clamgrok?virus=OSX&search-type=contains&case-sensitivity=No&database=daily&database=main&display=database&display=virus&.submit=Submit+Query&.cgifields=database&.cgifields=search-type&.cgifields=case-sensitivity&.cgifields=display

 

Sophos:-

 

http://www.sophos.com/en-us/search-results.aspx?refine=1a1e9ea6979a493dba64e1b2ced03044&search=osx

 

Mcafee:-

 

http://home.mcafee.com/VirusInfo/ThreatSearch.aspx?term=osx

http://home.mcafee.com/VirusInfo/ThreatSearch.aspx?term=mac

 

Norton for OSX Malware detections

 

http://www.symantec.com/security_response/landing/azlisting.jsp?azid=O

 

Kaspersky

 

http://www.securelist.com/en/descriptions?words=osx&behavior=&Search=Search&search_type=1

http://www.securelist.com/en/descriptions?words=mac&behavior=&Search=Search&search_type=1

 

Macscan spyware list

 

http://macscan.securemac.com/spyware-list/