New Mac OS X Botnet Discovered By Researcher's of Dr. Web Which Infected More Than 17000 Machines
Namaste! Good Morning,
Apple Mac OS X users are infected by a malware named Mac.BackDoor.iWorm . This is considered to be complex multi purpose backdoor. Criminals can issue commands that get this program to carry out a wide range of instructions on the infected machines. It is analysed and recorded that the machines infected by Mac.BackDoor.iWorm is near about 17000 .
This malware was developed using C++ and Lua. It should also be noted that the malware makes extensive use of encryption in its routines. During installation it is extracted into /Library/Application Support/JavaW, after which the dropper generates a p-list file so that the malware is launched automatically.
Doctor Web's researchers statistics show that as of September 26, 2014, 17,658 IP addresses of infected devices were involved in the botnet/malware created by Criminals using Mac.BackDoor.iWorm. Most of them—4,610 (representing 26.1% of the total)—reside in the United States. Canada ranks second with 1,235 addresses (7%), and the United Kingdom ranks third with 1,227 IP addresses of infected computers (6.9% of the total). The late September 2014 geographical distribution of the botnet/malware created with Mac.BackDoor.iWorm is shown in the following illustration:
In order to acquire a control server address list, this malware uses the search service at reddit.com, and—as a search query—specifies hexadecimal values of the first 8 bytes of the MD5 hash of the current date. The reddit.com search returns a web page containing a list of botnet C&C servers and ports published by criminals in comments to the post minecraftserverlists under the account vtnhiaovyd.
The bot picks a random server from the first 29 addresses on the list and sends queries to each of them. Search requests to acquire the list are sent to reddit.com in five-minute intervals.
This malware has Lua Script which is capable to perform many actions like Get the OS Type, Get the value from the configuration file, get Botnet uptime, Send a GET Query , Download a file, Execute a system instruction and many more .
It is said by Dr Web's Researchers that the signature of this malware has been added to the virus database, so Mac.BackDoor.iWorm poses no danger to Macs protected with Dr.Web Anti-virus for Mac OS X.
Apple Mac OS X users are infected by a malware named Mac.BackDoor.iWorm . This is considered to be complex multi purpose backdoor. Criminals can issue commands that get this program to carry out a wide range of instructions on the infected machines. It is analysed and recorded that the machines infected by Mac.BackDoor.iWorm is near about 17000 .
This malware was developed using C++ and Lua. It should also be noted that the malware makes extensive use of encryption in its routines. During installation it is extracted into /Library/Application Support/JavaW, after which the dropper generates a p-list file so that the malware is launched automatically.
Doctor Web's researchers statistics show that as of September 26, 2014, 17,658 IP addresses of infected devices were involved in the botnet/malware created by Criminals using Mac.BackDoor.iWorm. Most of them—4,610 (representing 26.1% of the total)—reside in the United States. Canada ranks second with 1,235 addresses (7%), and the United Kingdom ranks third with 1,227 IP addresses of infected computers (6.9% of the total). The late September 2014 geographical distribution of the botnet/malware created with Mac.BackDoor.iWorm is shown in the following illustration:
In order to acquire a control server address list, this malware uses the search service at reddit.com, and—as a search query—specifies hexadecimal values of the first 8 bytes of the MD5 hash of the current date. The reddit.com search returns a web page containing a list of botnet C&C servers and ports published by criminals in comments to the post minecraftserverlists under the account vtnhiaovyd.
The bot picks a random server from the first 29 addresses on the list and sends queries to each of them. Search requests to acquire the list are sent to reddit.com in five-minute intervals.
This malware has Lua Script which is capable to perform many actions like Get the OS Type, Get the value from the configuration file, get Botnet uptime, Send a GET Query , Download a file, Execute a system instruction and many more .
It is said by Dr Web's Researchers that the signature of this malware has been added to the virus database, so Mac.BackDoor.iWorm poses no danger to Macs protected with Dr.Web Anti-virus for Mac OS X.
