OSX/OceanLotus [Threat Name] go to Threat

OSX/OceanLotus.A [Threat Variant Name]

Category trojan
Size 275243 B
Detection created Jan 22, 2016
Detection database version 12912
Aliases Mac.BackDoor.OceanLotus.1 (Dr.Web)
  Trojan.MAC.OceanLotus.A (F-Secure)
  OSX/OceLotus-A (Sophos)
Short description

The trojan serves as a backdoor. It can be controlled remotely.


The trojan disguises itself as the Adobe Flash update application.

When executed, the trojan copies itself into the following location:

  • /Library/Logs/.Logs/corevideosd

In order to be executed on every system start, the trojan creates the following file:

  • /Library/LaunchAgents/com.google.plugins.plist

The trojan creates the following folders:

  • /Library/Logs/.Logs
  • /Library/Parallels/
  • /Library/Hash/.Hashtag
  • /Library/.SystemPreferences/.prev/

The trojan creates the following files:

  • /Library/Hash/.Hashtag/.hash
  • /Library/Parallels/.cfg
  • /Library/.SystemPreferences/.prev/.ver.txt
Information stealing

OSX/OceanLotus.A is a trojan that steals sensitive information.

The trojan collects the following information:

  • screenshots
  • computer name
  • user name
  • list of recently opened/executed files
  • operating system version

The trojan attempts to send gathered information to a remote machine.

Other information

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a list of (3) URL addresses. The HTTP protocol is used in the communication.

It can execute the following operations:

  • download files from a remote computer and/or the Internet
  • run executable files
  • execute shell commands
  • update itself to a newer version
  • capture screenshots
  • terminate running processes
  • delete files
  • delete folders

The trojan can be used to gain full access to the compromised computer.

Please enable Javascript to ensure correct displaying of this content and refresh this page.