New Mac Malware from Eset

Rusli · August 2012

New Mac Malware from Eset Threat Center. Please take note.

OSX/Morcut

OSX/Agent.AA

OSX/Flashback.K

OSX/Getshell.B,

OSX/Getshell.A, OSX/Siggen.A,

OSX/MacKontrol.A

OSX/Siggen.A

OSX/Filecoder.B

OSX/Filecoder.A

OSX/Flashback.L

OSX/Lamadai.C

Check thru

http://go.eset.com/us/threat-center/threatsense-updates/page/1/?q=osx

Ikarus detects

Exploit.OSX.Safari.a
Worm.OSX.Inqtana.a
Java.OSX.Inqtana
Worm.OSX.Niqtana.a
Virus.OSX.Macarena.a
Trojan.Osx.Exploit.Launchd.B
Trojan.Osx.Exploit.Launchd.A
Trojan.OSX.Imunizator
Virus.OSX.Leap.B
Trojan.OSX.Loader.A
Hoax.OSX.Mcsweeper.a
Virus.OSX.Niqtana.D
Virus.OSX.Macarena
Worm.OSX.Inqtana
Exploit.OSX.Safari
Exploit.OSX.Launch
Trojan.OSX.Dropper
Trojan.OSX.Loader
Hoax.OSX.Mcsweeper
JS.OSX.Troj
Trojan-Downloader.OSX.Jahlav
Virus.OSX.RSPlug
Virus.OSX.Weapox
Backdoor.OSX.Lamzev
Trojan.OSX.Jahlav
Trojan.Osx.Exploit.Launchd
Trojan-PWS.OSX.Corpref
OSX.Trojan-PWS.Corpref
MAC.OSX.Trojan.DNSChanger
IM-Worm.OSX.Leap
Worm.OSX.Niqtana
Win32.Worm.Osx.Niqtana
Trojan.Exploit.Osx.Launch
Rootkit.OSX.Weapox
Trojan.Osx.Weapox
Suspect.OSX.iWorkS
Backdoor.OSX.iWorm
MAC.OSX.Trojan.Krowi
Virus.OSX.Niqtana
not-a-virus:FraudTool.OSX.iMunizator
OSX.Worm.Tored
Worm.OSX.Tored
Email-Worm.OSX.Tored
Exploit.OSX.Libtiff
Exploit.OSX.Smid
not-a-virus:Monitor.OSX.Keylogger
Trojan.OSX.Gaslome
not-a-virus:RiskTool.OSX.Baoba
Trojan.OSX.HellRTS
not-a-virus:NetTool.OSX.Mech
Backdoor.OSX.Reshe
not-a-virus:RemoteAdmin.OSX.Cowhand
Trojan.OSX.Spynion
Backdoor.OSX.Sunam
Trojan.OSX.Inqtana
MAC.OSX.Trojan.Boonana
Trojan.OSX.Launchd
MAC.OSX.Spyware.OpinionSpy
Backdoor.OSX.BlackHol
Hoax.OSX.Defma
MAC.OSX.Trojan.FakeAlert.A
MAC.OSX.Trojan.FakeAlert.B
MAC.OSX.Trojan.FakeAlert.C
Trojan-Downloader.OSX.FavDonw
MAC.OSX.Trojan.FakeAlert
MAC.OSX.Backdoor.BlackHol
MAC.OSX.Trojan.FakeAlert.D
MAC.OSX.Trojan.FakeAlert.F
MAC.OSX.Trojan.FakeAlert.G
MAC.OSX.Trojan.FakeAlert.E
MAC.OSX.Trojan.FakeAlert.H
Backdoor.OSX.Olyx
MAC.OSX.AdWare.MacSweeper
Backdoor.OSX.Imuler
Trojan-Dropper.OSX.Revir
Trojan-Downloader.OSX.Revir
Trojan-Downloader.OSX.Flashfake
Application.Osx.Cosmac
MAC.OSX.Backdoor.Tsunami
Trojan.OSX.Agent
Backdoor.OSX.Miner
Trojan.OSX.Miner
MAC.OSX.Trojan.DevilRobber
Application.Posx
MAC.OSX.Trojan.FlashBack
MAC.OSX.Trojan.FakeAlert.I
MAC.OSX.Backdoor.Olyx
OSX.Niqtana
Hoax.OSX.MacKeeper
MAC.OSX.Trojan.FakeAlert.J
MAC.OSX.Trojan.Imuler
MAC.OSX.Trojan.Lamadai
Backdoor.OSX.MaControl
not-a-virus:Monitor.OSX.LogKext
not-a-virus:Monitor.OSX.SniPo
OSX.Weapox
OSX.Safari
Backdoor.OSX.SabPub
Backdoor.OSX.Flashback
not-a-virus:Monitor.OSX.BackTrack
Backdoor.OSX.Lasyr
not-a-virus:Monitor.OSX.SpyMe
MAC.OSX.Backdoor.Imuler
MAC.OSX.Trojan.Revir
Backdoor.OSX.GetShell
Backdoor.OSX.Morcut
Rootkit.OSX.Morcut
Trojan.OSX.Morcut

garlangreeny · August 2012

Nice list of threats here. Thanks for the post.

Rusli · October 2012

There's more here is the new updates for Mac Malware.

dated from 7 Aug 2012 to 17 Oct 2012.

OSX/Agent.AB

OSX/HellRTS.AD

OSX/Rootkit.Rubilyn.A

OSX/Siggen.A

OSX/Revir.B

OSX/TrojanDownloader.Jahlav.NAJ

OSX/Imuler.D

OSX/Adware.MacDefender.A

OSX/Cyanide.A

OSX/Adware.MacDefender.O

OSX/Blackhole.C

OSX/HellRTS.AC

OSX/Macarena.A

OSX/DevilRobber.D

OSX/HellRTS.AB

OSX/OpinionSpy.D

OSX/Getshell.B

Win32/Qhost.OSX (I'm not that sure with this one.)

OSX/Getshell.B

Win32/Qhost.OSX (same as the above.)

check here: - http://go.eset.com/us/threat-center/threatsense-updates/page/1/?q=osx

Some newer ones which Ikarus reported. ( I think kaspersky for mac is using the same virus signatures with Ikarus)

Backdoor.OSX.Wirenet

MAC.OSX.Trojan.FinSpy
Trojan.OSX.FakeCo
MAC.OSX.Trojan.Agent
MAC.OSX.Trojan.FakeAlert.K
MAC.OSX.Trojan.FakeAlert.L
MAC.OSX.Macarena
Mac.OSX.Trojan.MacControl

check here:- http://www.ikarus.at/en/private/info-center/virus-lexicon/index.html?action=search&term=osx&what=name

Intego detect a new Mac malware called Jacksbot

http://www.intego.com/mac-security-blog/new-multiplatform-backdoor-jacksbot-discovered/

Janiashvili · October 2012

Rusli, sincerely, why you're writing everything like this here???

Rusli · October 2012

There are people from f-secure needs to know.

There are people in the forum needs to know about this too.

Janiashvili · October 2012

I don't think people at f-secure don't know about this; and about forum, who reads this forum except one or two like us?

Rusli · November 2012

Not onlly F-Secure staff need to know, there are people here need to be aware and know what is happening before they got hit by new Mac viruses.

At least they are confident how to tackle problems!

Rusli · November 2012

last updates of known Mac Viruses.

Backdoor.OSX.Wirenet

MAC.OSX.Trojan.FinSpy ( I think this is FinFisher trojan! )
Trojan.OSX.FakeCo
MAC.OSX.Trojan.Agent
MAC.OSX.Trojan.FakeAlert.K
MAC.OSX.Trojan.FakeAlert.L
MAC.OSX.Macarena
Mac.OSX.Trojan.MacControl
MAC.OSX.Trojan.WeaponX
MAC.OSX.HackTool.Rubilyn

http://www.ikarus.at/en/private/info-center/virus-lexicon/index.html?action=search&term=osx&what=name

http://go.eset.com/us/threat-center/threatsense-updates/search/?q=osx

http://macscan.securemac.com/spyware-list/

http://www.freedrweb.com/drweb+mac+light/

Rusli · November 2012

Eset Threat Center:- Malware for OS X

OSX/MacKontrol.B

OSX/Morcut.B

OSX/Getshell.C

OSX/TrojanDownloader.Jahlav.NAO

OSX/Iservice.AE

OSX/Imuler.B

Win32/Kryptik.AOSX

OSX/Imuler.E

OSX/Agent.AB

OSX/HellRTS.AD

OSX/Rootkit.Rubilyn.A

OSX/Siggen.A

OSX/Revir.B (2), OSX/TrojanDownloader.Jahlav.NAJ

Detection dated on Sept 27 2012 to Nov 24 2012.

http://go.eset.com/us/threat-center/threatsense-updates/page/1/?q=osx

Ikarus:-

http://www.ikarus.at/en/private/info-center/virus-lexicon/index.html?action=search&term=osx&what=name

Backdoor.OSX.SabPub

Backdoor.OSX.Flashback
not-a-virus:Monitor.OSX.BackTrack
Backdoor.OSX.Lasyr
not-a-virus:Monitor.OSX.SpyMe
MAC.OSX.Backdoor.Imuler
MAC.OSX.Trojan.Revir
Backdoor.OSX.GetShell
Backdoor.OSX.Morcut
Rootkit.OSX.Morcut
Trojan.OSX.Morcut
Backdoor.OSX.Wirenet
MAC.OSX.Trojan.FinSpy
Trojan.OSX.FakeCo
MAC.OSX.Trojan.Agent
MAC.OSX.Trojan.FakeAlert.K
MAC.OSX.Trojan.FakeAlert.L
MAC.OSX.Macarena
Mac.OSX.Trojan.MacControl
MAC.OSX.Trojan.WeaponX
MAC.OSX.HackTool.Rubilyn

ClamAV Search Database for OSX Malware

http://clamav-du.securesites.net/cgi-bin/clamgrok?virus=OSX&search-type=contains&case-sensitivity=No&database=daily&database=main&display=database&display=virus&.submit=Submit+Query&.cgifields=database&.cgifields=search-type&.cgifields=case-sensitivity&.cgifields=display

Sophos:-

http://www.sophos.com/en-us/search-results.aspx?refine=1a1e9ea6979a493dba64e1b2ced03044&search=osx

Mcafee:-

http://home.mcafee.com/VirusInfo/ThreatSearch.aspx?term=osx

http://home.mcafee.com/VirusInfo/ThreatSearch.aspx?term=mac

Norton for OSX Malware detections

http://www.symantec.com/security_response/landing/azlisting.jsp?azid=O

Kaspersky

http://www.securelist.com/en/descriptions?words=osx&behavior=&Search=Search&search_type=1

http://www.securelist.com/en/descriptions?words=mac&behavior=&Search=Search&search_type=1

Macscan spyware list

http://macscan.securemac.com/spyware-list/

New Mac Malware from Eset

Comments

Categories