Kaspersky Lab has once again found a nasty little piece of malware that started out in Linux and made the jump to Windows. These cross-platform backdoors spy on the user and are by no means the first backdoor virus of this kind.

Cross-Platform Backdoors Start With Linux

Stefan Ortloff posted a detailed breakdown of the malware on Securelist. According to that information, the malware was named DropboxCache (also called Backdoor.Linux.Mokes.a). It has a number of features that can monitor the victim’s activities, including code to record audio and take screen shots. It’s written in C++ and Qt, a cross-platform application framework.

The cross-platform backdoors connect to a command-and-control (C&C) server and then issue an HTTP request to the C&C every minute. Images are sent to the infected machine in response.

After the malware executes for the first time, it copies itself to one of two locations. To make itself persistent, it creates a desktop file in $HOME/.config/autostart/$filename.desktop.

Once functioning, it collects information from its keylogger, along with audio captures and screenshots. It will upload this collected data to the C&C at a later time. There has been no attempt by the criminals to obfuscate the code at all; Ortloff noted in his blog post that this made his job much easier.

32-Bit Windows Is Next

Ortloff also found the malware in 32-bit Windows systems, though there are differences in how things work. For instance, DropboxCache randomly chooses one of nine different locations in %AppData% to persistently install itself on the machine. The SetWindowsHook API is utilized to establish keylogger functionality and to monitor mouse inputs and internal messages posted to the message queue. In a manner similar to the Linux version, it connects to the C&C server via port 443 and communicates at one-minute intervals.

In order not to alert the user that bad things are happening, the malware tries to masquerade as a normal program. DropboxCache does this by using Trusted Code Signing Certificates. The authors managed to sign the binary with a legitimate certificate from “COMODO RSA Code Signing CA.” Kaspersky did not post the name of the entity that was originally given the cert.

Will Mac OS X Get Hit?

Because of the platform-independent nature of the code, Ortloff thinks the malware’s migration to OS X might happen. But the actual mechanism of the malware would have to be totally recoded to even have a chance to work on Mac, and the rootless security system in newer versions of OS X might make persistence of action very hard to obtain.

Only time will tell if this occurs, but it seems less likely. In the meantime, users will have to be aware of the malware operating on Windows and Linux machines.