{"id":2777,"date":"2011-05-19T10:32:03","date_gmt":"2011-05-19T17:32:03","guid":{"rendered":"http:\/\/blog.intego.com\/?p=2777"},"modified":"2016-02-12T10:03:20","modified_gmt":"2016-02-12T18:03:20","slug":"blackhole-rat-evolves-again-new-variant-found","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/blackhole-rat-evolves-again-new-variant-found\/","title":{"rendered":"BlackHole RAT Evolves Again: New Variant Found"},"content":{"rendered":"

Intego has discovered a new variant of the BlackHole RAT which we discussed in February<\/a>. While the main principles of the tool – a remote administration tool – remain the same, it includes a backdoor, called Server.app, and a keylogger, called KeyLogger.app. It also adds these two latter elements to a user’s Login Items. The full toolkit is installed in a folder named .JavaUpdater; this folder is normally invisible, at least in the Finder, as are all items whose names begin with a period. <\/p>\n

The RAT also installs a video capture tool, available from a “normal” website – ie., not a hacker module – which can be eventually used to capture video from an iSight camera. All of these modules are written in RealBasic, a portable, cross-platform language that creates executables using a runtime. <\/p>\n

\"\"<\/p>\n

For now, the risk is still very low. Malicious users need access to Macs to install this software, either by physically accessing a Mac, or by accessing it over a network. It is recommended to use a firewall, to prevent such network attacks, such as that found in Intego VirusBarrier X6<\/a>. <\/p>\n

\n

Download 30-day free trial<\/a><\/p>\n

Protect your Mac from malware<\/a><\/h4>\n

Download a free 30-day trial version of VirusBarrier X6 and save $5<\/a><\/p>\n

<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Intego has discovered a new variant of the BlackHole RAT, a remote administration tool that can affect Macs. The risk is still low.<\/p>\n","protected":false},"author":3,"featured_media":2784,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[190],"tags":[2719,62,86],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\t\n\t\n\t\n