{"id":21938,"date":"2014-01-20T14:58:15","date_gmt":"2014-01-20T22:58:15","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=21938"},"modified":"2016-10-07T12:19:36","modified_gmt":"2016-10-07T19:19:36","slug":"new-osx-crisis-variant-invokes-pope-francis","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-variant-invokes-pope-francis\/","title":{"rendered":"New OSX\/Crisis Variant Invokes Pope Francis"},"content":{"rendered":"

A new sample of OSX\/Crisis<\/a>, the too popular Da Vinci rootkit from Hacking Team, reached our Malware Lab<\/a>\u00a0during the weekend.\u00a0We currently do not have information about the origin of the file on VirusTotal, named “Frantisek,” but it is an Eastern European first name meaning Francis. Could it be related to Pope Francis?<\/p>\n

Like the\u00a0previous<\/a>\u00a0variants<\/a>,\u00a0OSX\/Crisis.C is delivered through a dropper that installs silently, without requiring a password, and works on Mac OS X 10.5, 10.6, and 10.7. However, Hacking Team has updated some of the dropper code and the backdoor configuration file format.<\/p>\n

The dropper executes an unusual segment: __INITSTUB. The original entry point EIP points to this code segment before reaching the almost empty _main function of the program. For this reason, an incautious researcher using a debugger could get infected without even noticing it.\u00a0While it uses a different way to resolve system symbols, it crashes on OS X Mountain Lion or OS X Mavericks (segmentation fault). This might be a 64-bit bug in the malware.<\/p>\n

Following is a screenshot of the resolved symbols hash of the dropper in\u00a0IDA<\/a>:<\/p>\n

\"OSX\/Crisis.C<\/a><\/p>\n

When the dropper runs successfully, it hides the following files in the user’s home directory (in the Library\/Preferences folder), inside a fake application bundle called\u00a0OvzD7xFr.app:<\/p>\n