OSX Backdoor Mokes

OSquery

(https://securelist.com/blog/research/75990/the-missing-piece-sophisticated-os-x-backdoor-discovered/):

Query

select * from file where \\
        path LIKE '/Users/%/Library/App Store/storeuserd' OR \\
        path LIKE '/Users/%/Library/com.apple.spotlight/SpotlightHelper' OR \\
        path LIKE '/Users/%/Library/Dock/com.apple.dock.cache' OR \\
        path LIKE '/Users/%/Library/Dropbox/DropboxCache' OR \\
        path LIKE '/Users/%/Library/Skype/SkypeHelper' OR \\
        path LIKE '/Users/%/Library/Google/Chrome/nacld' OR \\
        path LIKE '/Users/%/Library/Firefox/Profiles/profiled';

Additional Query Info

  • Version: 1.4.5
  • Interval: 3600

JSON

{
  "queries": {
    "OSX Backdoor Mokes": {
      "query": "select * from file where \\
        path LIKE '/Users/%/Library/App Store/storeuserd' OR \\
        path LIKE '/Users/%/Library/com.apple.spotlight/SpotlightHelper' OR \\
        path LIKE '/Users/%/Library/Dock/com.apple.dock.cache' OR \\
        path LIKE '/Users/%/Library/Dropbox/DropboxCache' OR \\
        path LIKE '/Users/%/Library/Skype/SkypeHelper' OR \\
        path LIKE '/Users/%/Library/Google/Chrome/nacld' OR \\
        path LIKE '/Users/%/Library/Firefox/Profiles/profiled';",
      "interval": "3600",
      "platform": "",
      "version": "1.4.5",
      "description": "(https://securelist.com/blog/research/75990/the-missing-piece-sophisticated-os-x-backdoor-discovered/)",
      "value": ""
    }
  }
}