TrojanDownloader:MacOS/Jahlav.C

TrojanDownloader:MacOS/Jahlav.C is an obfuscated shell script that downloads other malware and is dropped and executed on the local computer by TrojanDownloader:MacOS/Jahlav.A..

TrojanDownloader:MacOS/Jahlav.C is installed by TrojanDownloader:MacOS/Jahlav.A. This script (normally named "AdobeFlash") is dropped in the folder "/Library/Internet Plug-Ins" and is obfuscated.

 

This malware decrypts and drops another obfuscated shell script. This second-level script decrypts and drops a Perl script. The malware then adds crontab entries to run the Perl script every 5 minutes.

The Perl script attempts to connect to a remote machine and download the next main malicious payload. This payload can change at any time and its content and distribution are controlled by the malware author.