(http://www.thesafemac.com/arg-downlite/): Artifact used by this malware
Query:
select * from launchd where \ name = 'com.vsearch.agent.plist' OR \ name = 'com.vsearch.daemon.plist' OR \ name = 'com.vsearch.helper.plist' OR \ name = 'Jack.plist' OR \ program_arguments = '/etc/run_upd.sh' OR \ program_arguments LIKE '/Library/Application Support/%/Agent/agent.app/Contents/MacOS/agent%';Additional Query Info:
Version: 1.4.5
Platform: darwin
Interval: 3600
JSON:
{ "queries": { "Vsearch": { "query" : "select * from launchd where \ name = 'com.vsearch.agent.plist' OR \ name = 'com.vsearch.daemon.plist' OR \ name = 'com.vsearch.helper.plist' OR \ name = 'Jack.plist' OR \ program_arguments = '/etc/run_upd.sh' OR \ program_arguments LIKE '/Library/Application Support/%/Agent/agent.app/Contents/MacOS/agent%';", "interval" : "3600", "platform" : "darwin", "version": "1.4.5", "description" : "(http://www.thesafemac.com/arg-downlite/)", "value" : "Artifact used by this malware" } } }