{"id":11641,"date":"2013-03-08T12:15:47","date_gmt":"2013-03-08T20:15:47","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=11641"},"modified":"2026-07-04T02:23:36","modified_gmt":"2026-07-04T09:23:36","slug":"new-sabpab-backdoor-variant-found","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/new-sabpab-backdoor-variant-found\/","title":{"rendered":"New Sabpab Backdoor Variant Found"},"content":{"rendered":"

Every now and again, we’ll see new variants of popular malware families, especially when those malware families are commonly used in targeted attacks. Today’s new variant is from the Sabpab family that has previously been used to target Tibetan activists<\/a>. This time it was found on VirusTotal as a Java archive, which acts as a dropper. Once run, it creates a backdoor on the machine that connects to a remote site (www.coremail.info) to await commands.<\/p>\n

The trojan creates a LaunchAgent in an affected user’s Library folder to persist after reboot. It uses the same file name as previous variants:<\/p>\n