Malware
Eleanor
Eleanor comes as a drag-and-drop file utility called EasyDoc Converter.
Eleanor is a macOS malware family.
Background
Eleanor is distributed as a drag-and-drop file tool named EasyDoc Converter. The application bundle conceals a shell script that masquerades under the Dropbox name and deploys three pieces: a hidden Tor service, a Pastebin agent, and a web service with a PHP-based graphical interface.
The Tor service turns the victim's machine into a server, granting attackers fully anonymous access via a Tor-generated address.
The Pastebin agent uploads that address in encrypted form to Pastebin, where the attackers can retrieve it.
The web service is the core malicious component, handing the attackers control over the infected machine. Once authenticated, the interface presents several control panels that let them perform the following actions:
- Managing files
- Listing processes
- Connecting to various database management systems such as MySQL or SQLite
- Connecting via bind/reverse shell
- Executing shell command
- Capturing and browsing images and videos from the victim’s webcam
- Sending emails with an attachment
Source: Malpedia (Fraunhofer FKIE).