Trojan.MacOS.SLISP.A
Trojan.OSX.SilverSparrow (IKARUS)
OSX
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan may be unknowingly downloaded by a user while visiting malicious websites.
TECHNICAL DETAILS
Arrival Details
This Trojan may be unknowingly downloaded by a user while visiting malicious websites.
Installation
This Trojan adds the following folders:
- /Users/scbox/Library/Application Support/agent_updater
Dropping Routine
This Trojan drops the following files:
- ~/Library/LaunchAgents/init_agent.plist -> persistence for agent.sh
- ~/Library/Application Support/agent_updater/agent.sh -> detected as Trojan.SH.SLISP
Download Routine
This Trojan connects to the following website(s) to download and execute a malicious file:
- https://mobiletraits.s3.{BLOCKED}aws.com/version.json
Information Theft
This Trojan gathers the following data:
- Query String:
- sqlite3 /Users/scbox/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 select LSQuarantineDataURLString from LSQuarantineEvent where LSQuarantineDataURLString like \"%stu=3c55805%\" order by LSQuarantineTimeStamp desc
Stolen Information
This Trojan sends the gathered information via HTTP POST to the following URL:
- http://api.{BLOCKED}traits.com/pkl
Other Details
This Trojan connects to the following possibly malicious URL:
- mobiletraits.s3.{BLOCKED}aws.com
- s3-1-w.{BLOKCED}aws.com
- api.{BLOCKED}traits.com
It does the following:
- This malware is a pkg file (updater.pkg) that contains malicious pre-install scripts inside the Distribution.xml file -> detected as Trojan.XML.SLISP.A
- The Distribution.xml file contains javascript codes to run system commands and does the routine:
- Creates file init_agent.plist
- Creates file agent.sh
- Downloads version.plist
- Run init_agent.plist
- agent.sh downloads and runs its payload
- Query Download Data
- Init_agent.plist calls agent.sh every hour
- The url that agent.sh downloads is dependent from another downloaded file from https://mobiletraits.s3.{BLOCKED}aws.com/version.json and is stored in /tmp/version.json
- The .pkg file will also execute the bystander binaries file
SOLUTION
Scan your computer with your Trend Micro product to delete files detected as Trojan.MacOS.SLISP.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:
Did this description help? Tell us how we did.