The Latest in IT Security

Mac Trojan Flashback.B Checks for VM


One of our analysts has discovered something interesting while debugging the latest version of Flashback, a Mac trojan that attempts to trick people into believing it’s an Adobe Flash Player update.

While comparing the differences between Flashback.A and Flashback.B, he saw this routine:

vmcheck, Trojan-Downloader:OSX/Flashback.B

Flashback.B performs a “vmcheck”. If virtualization is detected, the trojan aborts itself.

Apple started allowing users to run two additional instances of virtualized OS X with the release of Lion.

VMware-aware malware (say that ten times fast!) is a common anti-research technique used within the Windows ecosystem, but not yet so in Mac’s. It appears that Mac malware authors are anticipating that researchers will begin to use virtualized environments during analysis, and are taking steps to hamper such efforts.

Threat Solutions post by — Brod

Leave a reply


TUESDAY, JULY 23, 2019

Mission-Critical Broadband – Why Governments Should Partner with Commercial Operators:
Many governments embrace mobile network operator (MNO) networks as ...

ARA at Scale: How to Choose a Solution That Grows With Your Needs:
Application release automation (ARA) tools enable best practices in...

The Multi-Model Database:
Part of the “new normal” where data and cloud applications are ...



Latest Comments

Social Networks