Skip to content

XProtect.plist #8

Description

@0ptiKali1usion

Marked as malware, I beleve.

/System/Library/CoreServices/XProtect.bundle/Contents/XPRotect.plist:

    <dict>
            <key>Description</key>
            <string>OSX.Mughthesec.B</string>
            <key>LaunchServices</key>
            <dict>
                    <key>LSItemContentType</key>
                    <string>com.apple.application-bundle</string>
            </dict>
            <key>Matches</key>
            <array>
                    <dict>
                            <key>MatchFile</key>
                            <dict>
                                    <key>NSURLTypeIdentifierKey</key>
                                    <string>public.unix-executable</string>
                            </dict>
                            <key>MatchType</key>
                            <string>Match</string>
                            <key>Pattern</key>
                            <string>42756E646C654D655570</string>
                    </dict>
                    <dict>
                            <key>MatchFile</key>
                            <dict>
                                    <key>NSURLTypeIdentifierKey</key>
                                    <string>public.unix-executable</string>
                            </dict>
                            <key>MatchType</key>
                            <string>Match</string>
                            <key>Pattern</key>
                            <string>5075626C69736865724F666665725374617465</string>
                    </dict>
                    <dict>
                            <key>MatchFile</key>
                            <dict>
                                    <key>NSURLTypeIdentifierKey</key>
                                    <string>public.unix-executable</string>
                            </dict>
                            <key>MatchType</key>
                            <string>Match</string>
                            <key>Pattern</key>
                            <string>496E7374616C6C50726F67726573735374617465</string>
                    </dict>
                    <dict>
                            <key>MatchFile</key>
                            <dict>
                                    <key>NSURLTypeIdentifierKey</key>
                                    <string>public.unix-executable</string>
                            </dict>
                            <key>MatchType</key>
                            <string>Match</string>
                            <key>Pattern</key>
                            <string>416476657274697365724F666665725374617465</string>
                    </dict>
                    <dict>
                            <key>MatchFile</key>
                            <dict>
                                    <key>NSURLTypeIdentifierKey</key>
                                    <string>public.unix-executable</string>
                            </dict>
                            <key>MatchType</key>
                            <string>Match</string>
                            <key>Pattern</key>
                            <string>42657254616767656444617461</string>
                    </dict>
                    <dict>
                            <key>MatchFile</key>
                            <dict>
                                    <key>NSURLTypeIdentifierKey</key>
                                    <string>public.unix-executable</string>
                            </dict>
                            <key>MatchType</key>
                            <string>Match</string>
                            <key>Pattern</key>
                            <string>4245525072696E7456697369746F72</string>
                    </dict>
            </array>
    </dict>

and that last 4245525072696E7456697369746F72 part is BERVisitor which is the query keyword that lead me to the one instance in Google's search index of sites. How long have you been malware you think?
I am assuming things because I am unfamiliar with XProtect, but it seems to me BERVistor is blocked.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions