[Michael]

It's not often that I see a Trojan (DNS Changer) with same low detection rates on PC and Mac versions.

Well, these samples prove it. The 'bait' fake codec page is hosted at supertuberental.com

I downloaded and uploaded to Virus Total the two versions pretty much at the same time and here are the results

PC: 3/41

flash-plugin.45080.exe from exeloaddirect.com



Only 3 AV engines on Virus Total are detecting this threat: DrWeb, NOD32 and Sophos.

Mac: 3/41

QuickTimeUpdate.dmg from tablenoids.com



Only 3 AV engines on Virus Total are detecting this threat:*F-Secure, Kaspersky and Sophos.

Congrats to Sophos for detecting both the PC and Mac version of this threat!

Our heuristics engine Zheng detects this threat (the PC version) proactively as well.



Jerome Segura

Malware ID:*04f08886a6db5f01ebc7262db9fc5c88.zip

Malware ID:*4bc22ebef0dd2dc139e5afd9b46671ea.zip