Latest Mac Threat: ‘MacCinema’
Published:
March 23 2009, 11:30 PM
by
Methusela Cebrian Ferrer
OSX/Jahlav, the family of malware that has successfully penetrated the Mac world through social engineering – offering users free software, cracks and keygens – is now calling the installer for its latest variant, ‘MacCinema’ [Figure 01].
[Figure 01 – Rogue site]
Who would have thought the website shown above is a rogue site? Yes, it looks perfectly fine until you download "HDTVPlayerv3.5.dmg" and see the MacCinema Installer [Figure 02]:
[Figure 02 – MacCinema installer]
To avoid detection by scanners, the attacker continuously modifies a few strings in the script, then obfuscates and repackages it as shown in Figures 03 and 04.
[Figure 03 – Preinstall]
[Figure 04 – Sample DMG installers]
Overall, the behavior and installation sequence of this variant remains the same.
As described in our encyclopedia, OSX/Jahlav is a family of trojans that install and execute malicious script. The backdoor component listens to a remote server which often executes another script and thereafter modifies the user’s DNS settings by adding a new IP address starting with 85.xx.xx.xx.
We advise OS X users to be on the lookout to avoid falling for this malware’s tricks.