Analysis of MacProtector and MacDefender Draft Report

That recent malware that targeted Mac OSX systems, MacDefender and MacProtector, are fake anti-virus products designed to steal users personal information including credit card accounts. We think version OSX/MAcDefender.F tries to steal two credit card numbers by bouncing one and directing the user to another site. Below is our pending draft analysis for OSX/MacDefender.A , OSX/MacDefender.D and OSX/MacDefender.F.

Our analysis  includes takeaway’s of the evolution of key inherited traits within each rouge application followed by an detailed technical breakdown or the woking three variants we have. Our format is broken into stakeholder sections for executives, users, researchers and experienced MacOSX administrators. This report is a draft and may change without notification. 

Excerpts From Our Analysis 

Files 

/Contents/MacOS/MacDefender (OSX/MacDefender.A)

MD5(MacDefender)= 2f357b6037a957be9fbd35a49fb3ab72

SHA(MacDefender)= 470e1c99d7b5ec6d00b26715f4fa37bc70984fb4

/Contents/MacOS/MacProtector (OSX/MacDefender.D)

MD5(MacProtector)= 1f8e9cd3f0717a85b96f350e4f4a539a

SHA(MacProtector)= 361ba7b420e1a9ec0af5f7811e84dc95d04624a9

Added 05_21_2011

 /Contents/MacOS/MacProtector (OSX/MacDefender.F)

SHA(MacProtector)= a94bd6a52bcb275a8ff1cd15977167f709b7ab04

UPADTE PENDING

MacProtector (OSX/MacDefender.F) 

It is our theory that this version of MacProtector will trick the user into to providing two credit card numbers by directing them to two separate sites. It also can ensure that if one site is down the other will continue to steal credit cards. 

//

@interface URLMaster : NSObject

{

}

+ (id)getBuyPageIP; // IMP=0x000000010000f1f7

+ (id)getBackupBuyPageIP; // IMP=0x000000010000f1e8

+ (id)getSoftInstallLink; // IMP=0x000000010000f391

+ (id)getBuyPagLink; // IMP=0x000000010000f30d

+ (id)getBackupBuyPageLink; // IMP=0x000000010000f289

+ (id)getSendTicketLink; // IMP=0x000000010000f0a8

@end

@interface URLMaster : NSObject{}
+ (id)getBuyPageIP; // IMP=0x000000010000f1f7+ (id)getBackupBuyPageIP; // IMP=0x000000010000f1e8+ (id)getSoftInstallLink; // IMP=0x000000010000f391+ (id)getBuyPagLink; // IMP=0x000000010000f30d+ (id)getBackupBuyPageLink; // IMP=0x000000010000f289+ (id)getSendTicketLink; // IMP=0x000000010000f0a8
@end

• Both installers have the "ru.lproj" indicating the developer spoke Russian.
• Localizations for .nib files set to English.
• Localizations for application set to English.
• Xcode build for both was 10M2518, Xcode 3.2.6 / iOS SDK 4.3 gm which include Russian and English.
• The build machine which created both was running OSX seed 10J869, 10.6.7.
• Minimum system version is 10.5.
• Both use “df -lg|awk” to get disk space information.
• Both create and then write the output to a file named dmem.txt in the users ~/home folder
• Both use “ps -e|awk” to get process information.
• Both create and then write the output to a file named proc.txt in the users ~/home folder.
• Both use random number to seed timers, determine time to indicate infected file. (int)GetRndNum:(int)arg1:(int)arg2;
• Both use a method (void)setTimeIntervalForFirstVirAppearing to set the random time for first fake indication of virus to appear. 
• MacProtector has a superior coding operating structure as compared to MacDefender.
• MacDefender opened the default browser to make a purchase, MacProtector has the Webkit framework opening a WebKit container  to a site all built into the application
• MacDenfender link is dead, MacProtector link is still active remains active.
• MacDefender connect to 69 50 214 53 using default browser. (Site offline.)
• MacProtector connect to a nginx server 91 213 217 30. (Web and Reverse proxy) 
• MacProtector manages and obfuscates the IP address but the serial numbers are still stored in plain text, MacDefender does not obfuscate the site IP address. 
• MacProtector @Interface RegWindow handles the registration process, for example http : //91 213 217 30 / js / payform3 .js (Do not visit this link.)
• MacProtect uses token and cookies in the false activate product process.
• MacProtector uses various class methods to get ip address and confirm cookie from site.
• MacProtector sends data to 91 213 217 30. 
• MacProtector receives cookies from 91 213 217 30. 
• MacProtector uses methods (void)createURLForSerialNumberCookieSearch; and (void)OnCheckCookieForRegkey; to handle checking for registration cookie.
• MacProtector has a text file in resources called ksms.txt which contains the number “4”.
• MacProtector’s post flight script does not “reveal” the application in the Finder and does not use AppleScript.

Downloads-DRAFT

Update-Draft report v2.

Magmatic_Analysis_MacDefender_MacProtectorv2Draft.pdf (MAJOR UPDATE PENDING)

SHA(Magmatic_Analysis_MacDefender_MacProtectorv2Draft.pdf)= 72b17c4250da23ae3c744fb26508d2b1889ae49e

Draft report v1

Magmatic_Analysis_MacDefender_MacProtector(DRAFT)

sha=5a708a3751c3ddd7bf38fcf240d8abc676514452

Magmatic_Analysis_MacDefender_MacProtector(DRAFT)

sha=c20f74b6eef02667033ddf50ff8a4ef1a10c7f13

Class Diagrams

MacProtector (OSX/MacDefender.A)

OSX_MacDefender.A_ClassDiagramDraft2.pdf

  SHA(OSX_MacDefender.A_ClassDiagramDraft2.pdf)=d4b9902967f842773a563b215cae49ac5d3bde40

MacProtector (OSX/MacDefender.D)

OSX_MacDefender.D_ClassDiagramDraft2.pdf

SHA(OSX_MacDefender.D_ClassDiagramDraft2.pdf)= 2a92c951b9378d2370d559cbcbce873660fcc12d

MacProtector (OSX/MacDefender.F)

OSX_MacDefender.F_ClassDiagramDraft2.pdf

SHA(OSX_MacDefender.F_ClassDiagramDraft2.pdf)= 2b80717c46157cd2606dcbe6a7817e5993fb7ace

Class Dumps

MacDefenderOSX_MacDefender_A_ClasssDump (OSX/MacDefender.A)

SHA(MacDefenderOSX_MacDefender_A_ClasssDump.txt)= 5087f008da46bdd3cfacaf1be9d3729f19916f65

MacDefenderOSX_MacDefender_D_ClasssDump (OSX/macDefender.D)

SHA(MacProtector_OSX_MacDefender_D_ClassDump.txt)= a53cc5a8c9cd2f19726e56beed8b07a097d7b8e2

MacDefenderOSX_MacDefender_F_ClasssDump (OSX/MacDefender.F)

SHA(MacProtector_OSX_MacDefender_F_ClassDump.txt)= f26c0091ab26b1ca998d8f58e9ee133d967c5bd8

 **Note-This is draft data and contains raw information, final release of the document and addition updates will be located at here. All information is provided as is and falls under the copyright located on this site and within the draft report. Any questions use the Contact Us Link and put "MacDefenderProtector Report" in subject line. 

MacDefender Rouge Anti-Malware Program Removal and Defense

Intego has reported a new rouge Anti-Malware program targeting Mac OSX and Mac products. There are several things that can be done to mitigate the risk of this rouge product. Do not attempt to purchase this application via PayPal or Credit Card. If you have purchased it then report your credit card or PayPal account compromised immediately. 

Currently the risk from this product is low but users in various discussion forums are reporting that they already have downloaded and installed it. 

To remove the rouge Anti-Malware software if you downloaded it:

• If you have purchased this product call your credit card company or contact PayPal and report your account compromised immediately.
• Boot your Mac into "Safe Mode" by holding the shift key at startup.
• Clear out your "Downloads" folder or the folder you download files to. (Do this for all users.)
• Clear out you "Web History." (Do this for all users.)
• Go into System Preferences>Accounts>Login Items and remove MacDefender from the Startup list for any users. (Check every user including the local administrator account.)
• In Finder>File> Select search "This Mac." Enter Filename Contains "MacDefend."
• Select the "+" button and scroll down to Other and add "System files."

 

• Select "System Files are Included"

• Delete the Application by moving to the trash along with items in the Startup folder or files associated with MACDefender. This includes web pages in the cache /Library/StartupItems or ~/Library/StartupItems.
• Securely Empty Trash.
• Change all passwords for administrators and users on your Mac.
• Change your keyChain Password, make it different from the login password.
• As a precaution we also higly recommend that you change your passwords saved in browsers from Web Sites, especially iTunes and mail providers. (This is a good monthly or bi-monthly practice depending on your organization.)

How to Protect yourself:

• Do not install any program called MacDefender.
• Make sure "Open Safe Files" is deselected in Safari.
• Select "Clear Auto-Opening" settings in chrome://settings/advanced.
• Download files only to the Download folder that is in each users home directory.
• Set Remove Downloads to "When Safari Quits." Manually clear this folder for other Browsers.
• Make sure that "Block Pop-Up Windows" is on.
• Never do Web Surfing as the Administrator, carry out daily task as a user that does not have administrator privileges.
• Never use Safari on a Mac OSX Server.
• Download and confirm the hash before installing any files on assets in your control. (Recommended for enterprise customers.)
• Make sure "Auto Fill" is de-selected for all.
• Install a full featured anti-virus software, XProtect does not scan Meta Package File (.MPKG). (See references below.)

We continue to evaluate the risk created by rouge installers and malware related to Apple products. The "Human Interface Guidelines" which are key for any successful Apple developer to follow also creates risk skewed by users expectations of the Apple experience. We expect this to only increase in the future.

In our independent testing, using XCode and very little effort, we created various rouge installers which successfully convinced many Mac OSX users and Administrators they were safe to install. Far more Mac users were convinced by the Malware's ability to conform with the Apple operating system experience and never considered the source.

In our view the most threatening form of malware for Apple Productions is one that focuses on the MacOSX or iOS experience for the user. (This is very true for all GUI based computing devices, just more so on a platform that is experience driven.) Windows administrators and users have had to deal with this threat for sometime, whose experiences can beneficial as this threat continues to grow.

If you have not done so already we recommend installation of a complete Anti-Virus and Internet security package. Our favorite in Intego's Internet Barrier and we are very excited about F-Secure's beta offering. (Beta is not recommended for production critical systems.)

Update on Monday, May 2, 2011 at 12:22PM by Sean OConnell Public

One filename for the download is bestmacantivirus2011.mpkg.zip. Do not install this product.