Threat Encyclopedia

This Trojan comes as an attachment to spammed email. It carries with it a backdoor that runs on Mac OS X systems.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This Trojan drops and executes the following files:

• /tmp/launch-hs - a script that loads /tmp/launch-hse and /tmp/file.doc
• /tmp/launch-hse - detected by Trend Micro as either OSX_KONTROL.HVN or OSX_KONTROL.EVL

It drops the following non-malicious file:

• /tmp/file.doc

Dropping Routine

This Trojan takes advantage of the following software vulnerabilities to drop malicious files:

• (MS09-027) Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution (969514)

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

NOTES:
This malware is a Microsoft Word document file. If opened in Windows OS, the malicious routine does not execute successfully. However, if opened in Mac OS X, the malicious routine executes successfully.