# Menu ☰

**[intego.com/mac-security-blog/new-apple-mac-trojan-called-osxcrisis-discovered-by-intego-virus-team/](https://www.intego.com/mac-security-blog/new-apple-mac-trojan-called-osxcrisis-discovered-by-intego-virus-team/?)**

[Malware +](https://www.intego.com/mac-security-blog/category/malware/) [Recommended](https://www.intego.com/mac-security-blog/category/recommended/)

## New Apple Mac Trojan Called OSX/Crisis Discovered

[Posted on July 24th, 2012 by Lysa Myers](https://www.intego.com/mac-security-blog/author/lysam/)

**Update – July 25, 2012 10:30AM PDT**


July 25, 2012


This threat may run on Leopard 10.5, but it has a tendency to crash. It does not run on the
new Mountain Lion 10.8.
_______

Intego has discovered a new Trojan called OSX/Crisis. This threat is a dropper which creates
a backdoor when it’s run. It installs silently, without requiring a password, and works only in
OSX versions 10.6 and 10.7 – Snow Leopard and Lion.

The Trojan preserves itself against reboots, so it will continue to run until it’s removed.
Depending on whether or not the dropper runs on a user account with Admin permissions, it
will install different components. We have not yet seen if or how this threat is installed on a
user’s system; it may be that an installer component will try to establish Admin permissions.

If the dropper runs on a system with Admin permissions, it will drop a rootkit to hide itself. In
either case, it creates a number of files and folders to complete its tasks. It creates 17 files
when it’s run with Admin permissions, 14 files when it’s run without. Many of these are
randomly named, but there are some that are consistent.


-----

With or without Admin permissions, this folder is created in the infected user s home
directory:

~/Library/ScriptingAdditions/appleHID/

Only with Admin permissions, this folder is created:

/System/Library/Frameworks/Foundation.framework/XPCServices/

The backdoor component calls home to the IP address 176.58.100.37 every 5 minutes,
awaiting instructions. The file is created in a way that is intended to make reverse
engineering tools more difficult to use when analyzing the file. This sort of anti-analysis
technique is common in Windows malware, but is relatively uncommon for OS X malware.

It uses low-level system calls to hide its activities, as shown in the following images:


-----

-----

[Intego found samples of this malware on the VirusTotal website, a site used by security](https://www.virustotal.com/)
companies to share malware samples. This threat has not yet been found in the wild, and so
far there is no indication that this Trojan has infected users so right now the threat is
considered to be a low risk. Nonetheless, Intego VirusBarrier X6 detects and removes this
malware using today’s definitions. It detects the dropper component as OSX/Crisis, and the
backdoor component as Backdoor:OSX/Crisis. It will also block connections with the IP
address the backdoor component seeks to connect with.

[Intego VirusBarrier X6 users need to update as soon as possible to get protection from this](https://www.intego.com/virusbarrier)
threat.

We are still analyzing the threat at this time. We will post a more in-depth analysis as we
have more details.


-----