I saw mention of this on slack today - so wrote an EA that would see if any of the fleet had the two files present. It's rather rough and doesn't do the checksum if the files are there, however could be used to identify any macs for further investigation.
https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/
It needs 2 smart groups:
Infected
EAName is NOT None
EAName is NOT
Not Infected
EAName is None
#!/usr/bin/perl -w
my $userlist = `dscl . list /Users`;
chomp $userlist;
my @excludedusers = split(" ","daemon nobody _amavisd _appleevents _appowner _appserver _ard _assetcache _astris _atsserver _avbdeviced _calendar _ces _clamav _coreaudiod _coremediaiod _cvmsroot _cvs _cyrus _devdocs _devicemgr _displaypolicyd _distnote _dovecot _dovenull _dpaudio _eppc _ftp _gamecontrollerd _geod _iconservices _installassistant _installer _jabber _kadmin_admin _kadmin_changepw _krb_anonymous _krb_changepw _krb_kadmin _krb_kerberos _krb_krbtgt _krbfast _krbtgt _launchservicesd _lda _locationd _lp _mailman _mbsetupuser _mcxalr _mdnsresponder _mysql _netbios _netstatistics _networkd _nsurlsessiond _nsurlstoraged _ondemand _postfix _postgres _qtss _sandbox _screensaver _scsd _securityagent _serialnumberd _softwareupdate _spotlight _sshd _svn _taskgated _teamsserver _timezone _tokend _trustevaluationagent _unknown _update_sharing _usbmuxd _uucp _warmd _webauthserver _windowserver _www _wwwproxy _xserverdocs");
my @userslist = split("
", $userlist);
my @users;
my $result = "";
foreach my $u (@userslist) {
my $match = 0;
foreach my $e (@excludedusers) {
if ("$u" eq "$e") {
$match = 1;
}
}
if ($match == 0) {
push(@users, $u);
}
}
foreach (@users) {
my $home = `dscl . -read /Users/$_ NFSHomeDirectory | cut -d " " -f 2`;
chomp $home;
printf "home is $home
";
if (-e "$home/.client") {
$result = $result . "
$home/.client";
}
if (-e "$home/Library/LaunchAgents/com.client.client.plist") {
$result = $result . "
$home/Library/LaunchAgents/com.client.client.plist";
}
}
$result =~ s/^
+//;
if ($result =~ /^$/) {
system "echo "<result>None</result>"";
} else {
system "echo "<result>$result</result>"";
}
