4 ms·

Whoa, it aborts infection if you have XCode installed? Is this just to prevent itself from infecting someone's computer that might be able to study it?

by dinedal 15y ago

ImprovedSilence 15y ago
That would be my guess. Perhaps it wanted to stay un-detected, and un-reverse engineered as long as possible? It just played the numbers game in terms of time until discovery, and gave Xcode users some respect? Hence deleting itself in the presence of anti-virus software as well?
- stcredzero 15y ago
  It just played the numbers game in terms of time until discovery, and gave Xcode users some respect? I guess false negative was ok in this case. ;)
  - ImprovedSilence 15y ago
    Haha, yeah, I wrote the sentence as it appeared in my head, realized it was incomplete and would make no sense to anyone, then just kinda slid the rest in....
Cushman 15y ago
That is really clever.
pvarangot 15y ago
According to some malware researchers I've talked to it is not unusual to find that kind of hardcoded exceptions. I thought that it was to avoid infecting "clever" users, but they told me sometimes malware coders bundle those to avoid infecting their own computers (or their clients') without being to obvious about it. It's apparently not unusual to also find exceptions for IP blocks of whole countries or ISPs.
signalsignal 15y ago
I personally have XCode installed at /Applications/Xcode.app/Contents/MacOS/Xcode, so I ran the command at https://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml https://www.f-secure.com/v-descs/trojan-downloader_osx_flash... I got the "does not exist" result anyway, despite not having any of the software listed installed except for Java.
johnpowell 15y ago
I read that it also aborts and removes itself if Little Snitch is installed. I take requests from LS pretty seriously so it makes sense that they would do it. I would google the process and port if a random request occured.

Whoa, it aborts infection if you have XCode installed? Is this just to prevent itself from infecting someone's computer that might be able to study it?

by dinedal 15y ago

Whoa, it aborts infection if you have XCode installed? Is this just to prevent itself from infecting someone's computer that might be able to study it?

ImprovedSilence 15y ago

That would be my guess. Perhaps it wanted to stay un-detected, and un-reverse engineered as long as possible? It just played the numbers game in terms of time until discovery, and gave Xcode users some respect? Hence deleting itself in the presence of anti-virus software as well?

stcredzero 15y ago
It just played the numbers game in terms of time until discovery, and gave Xcode users some respect? I guess false negative was ok in this case. ;)
- ImprovedSilence 15y ago
  Haha, yeah, I wrote the sentence as it appeared in my head, realized it was incomplete and would make no sense to anyone, then just kinda slid the rest in....

Cushman 15y ago

That is really clever.

pvarangot 15y ago

According to some malware researchers I've talked to it is not unusual to find that kind of hardcoded exceptions. I thought that it was to avoid infecting "clever" users, but they told me sometimes malware coders bundle those to avoid infecting their own computers (or their clients') without being to obvious about it. It's apparently not unusual to also find exceptions for IP blocks of whole countries or ISPs.

signalsignal 15y ago

I personally have XCode installed at /Applications/Xcode.app/Contents/MacOS/Xcode, so I ran the command at https://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml https://www.f-secure.com/v-descs/trojan-downloader_osx_flash... I got the "does not exist" result anyway, despite not having any of the software listed installed except for Java.

johnpowell 15y ago

I read that it also aborts and removes itself if Little Snitch is installed. I take requests from LS pretty seriously so it makes sense that they would do it. I would google the process and port if a random request occured.