Backdoor:OSX/Sabpab.A

Summary

Backdoor:OSX/Sabpab.A connects to a remote server to receive further instructions, without the knowledge or permission from the user.

Disinfection & Removal

Manual Removal Instructions

• 1. Open Activity Monitor, select com.apple.PubSabAgent.pfile, and click Quit Process.
• 2. Open Terminal, then execute the following:
  • rm ~/Library/Preferences/com.apple.PubSabAgent.pfile
  • rm ~/Library/LaunchAgents/com.apple.PubSabAgent.plist

Technical Details

Arrival

Sabpab.A is dropped into the system by malicious Java applets that exploit the vulnerability identified by CVE-2012-0507, and malicious Word documents that exploit CVE-2009-0563.

Installation

The malware drops the following copy of itself:

• ~/Library/Preferences/com.apple.PubSabAgent.pfile

It creates the following launchpoint for the file above:

• ~/Library/LaunchAgents/com.apple.PubSabAgent.plist

Payload

The malware connects to a remote server to obtain additional commands. The server varies between samples. As of this writing, there are two known servers:

• rtx556[...].onedumb.com[...]
• 199[...].192.152.100[...]

The backdoor is capable of performing the following actions:

• Downloading and uploading files
• Creating new processes
• Taking screenshots