Digita Security

Cybersecurity solutions for the

  • modern
  • mobile
  • independent
  • innovative
  • enterprising

macOS workforce

8.28.2009 ( Version -4 )

IServiceA

Also Known As: OSX/iWorkS-A, OSX/iWorkServ

OSX/IServiceA is an OS X Backdoor that was spread via a trojaned iWork '09 free trial installer shared on peer-to-peer networks [1]. Discovered in early 2009, OSX/IServiceA was one of the first two signatures introduced into XProtect, when silently released as a part of Mac OS X 10.6.0 Snow Leopard [2].

References:
  1. https://www.symantec.com/connect/blogs/osxiservice-it-s-not-going-iwork-you
  2. http://www.macworld.com/article/1142457/snowleopard_malware.html

Sample Hashes (VT links):
43a929c2059440ea899baf47edcfb3ac764d3e0ef1bf4ba7917618e4821d9cb5