{"id":14789,"date":"2013-06-04T07:04:17","date_gmt":"2013-06-04T14:04:17","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=14789"},"modified":"2024-05-20T11:24:22","modified_gmt":"2024-05-20T18:24:22","slug":"clapzok-a-multi-platform-virus","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/clapzok-a-multi-platform-virus\/","title":{"rendered":"Multi-Platform Proof of Concept Virus Clapzok.A Examined"},"content":{"rendered":"

A multi-platform virus, named Multi\/Clapzok.A, have been released by researcher JPanic. It is written in Assembly, and targets Windows, Linux and OS X 32-bit executables.<\/p>\n

This proof of concept is an update of JPanic’s Capzloq Tekniq<\/a> (2006), that targets Windows and Linux operating systems. The OS X infection process is similar to the concept Roy G Biv exposed with MachoMan (2006) on VX Heavens.<\/p>\n

Peter Ferrie, Principal Anti-virus Researcher at Microsoft Corporation, has published an analysis in the Virus Bulletin issue of June 2013<\/a>. While this content is only available to subscribers, well known reverser Fractal Guru also published a technical analysis of the OS X infection<\/a> on his blog.<\/p>\n

In short, when the virus is executed, it looks for other 32-bit executables (either Windows, Linux or OS X native and FAT binaries) to replicate itself.<\/p>\n

\"multi\"<\/p>\n

On OS X, it modifies the __PAGEZERO load command to store its code, then changes the entry point in LC_UNIXTHREAD to trigger its execution. It then restores the original entry point in memory, so the infected program can run normally.<\/p>\n

It does not infect 64-bit executables (shellcode is 32-bit) or programs built with the latest Developer Tools, where GCC’s LC_UNIXTHREAD has been replaced by LC_MAIN in Clang. Also, fat binaries that contain both i386 and x86_64 architectures, running on a 64-bit machine, won’t execute the virus payload. Finally, a code-signed binary would detect the modification.<\/p>\n

Despite the significant limitations, this academics research is interesting as it exposes simple caveats Apple hasn’t patch since 2006.<\/p>\n

JPanic has not published his source code yet, and our malware researchers have not spotted any malicious use of his work.<\/p>\n

Intego VirusBarrier<\/a> with latest Virus Definitions detect Multi\/Clapzok.A and similar __PAGEZERO load command abuses.<\/p>\n","protected":false},"excerpt":{"rendered":"

A multi-platform virus, named Multi\/Clapzok.A, have been released by researcher JPanic. It is written in Assembly, and targets Windows, Linux and OS X 32-bit executables. This proof of concept is an update of JPanic’s Capzloq Tekniq (2006), that targets Windows and Linux operating systems. The OS X infection process is similar to the concept Roy […]<\/p>\n","protected":false},"author":29,"featured_media":8755,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[419,421,423,589],"class_list":["post-14789","post","type-post","status-publish","format-standard","has-post-thumbnail","category-security-news","tag-clapzok","tag-multi","tag-poc","tag-proof-of-concept"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t