OSX/XSLCmd [Threat Name] go to Threat

OSX/XSLCmd.A [Threat Variant Name]

Category	trojan
Size	115984 B
Detection created	Sep 08, 2014
Detection database version	10384
Aliases	Backdoor.OSX.Belfibod.a (Kaspersky)
	OSX.Slordu (Symantec)
	MacOS:XSLCmd-A (Avast)

The trojan serves as a backdoor. It can be controlled remotely.

When executed, the trojan copies itself in some of the the following locations:

The following files may be dropped:

This way the trojan ensures that the file is executed on every system start.

The trojan attempts to modify the following files:

The trojan creates the following folders:

The trojan may create the following folders:

The trojan may create the following files:

The trojan may execute the following commands:

After the installation is complete, the trojan deletes the original executable file.

OSX/XSLCmd.A is a trojan that steals sensitive information.

The following information is collected:

The trojan is able to log keystrokes.

The trojan searches for files with the following file extensions:

The trojan can send the information to a remote machine.

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a list of (3) URLs. The HTTP protocol is used.

It can execute the following operations: