Trojan:SH/RSPlug.A is an installed component of Trojan:MacOS/RSPlug.A, a Trojan for Mac OS X that modifies existing DNS settings. This Trojan may pose as a Mac codec in the form of a disk image file.

 

This Trojan is installed from a malicious disk image file for Mac OS X.

 

This malware was referenced in postings to various Web forums, alluding to adult content. When a user clicked the link, a Web page may be displayed with simple content and a link, such as this:

 

Quicktime Player is unable to play movie file.
Please click here to download new version of codec.

 

If a user clicked the download link, a file may be delivered with the following properties:

 

File name: ultracodec1237.dmg
FIle size: 17034
MD5 hash: 5291beb71cba2c5779119bff7a10abdb

 

The file is in Mac OS X disk image format, and can be mounted on a Mac computer using the Apple Disk Utility, and integrated in certain versions of OS X. This disk image file is compressed and contains various other files including:

 

Archive.bom

Archive.pax.gz

Info.plist

PkgInfo

150.bom

150.pax.gz

150.sizes

BundleVersions.plist

package_version

postinstall

preinstall

150.info

Description.plist

License.txt

 

The disk image file is coded to install an Internet plug-in that alters the specified DNS (Domain Name Server) to one that is attacker controlled. The net result is that a user request for a valid Web site could be diverted to a phishing Web site mirrored to resemble the official site.

 

This Trojan redirects Web traffic to two different DNS servers with these IP addresses:

 

85.255.115.114
85.255.112.176