detect-mokes.sh

#!/usr/bin/env bash
# Crude script to detect Backdoor.OSX.Mokes.a, as described in
# https://securelist.com/blog/research/75990/the-missing-piece-sophisticated-os-x-backdoor-discovered/
locations=(
  "$HOME/Library/App Store/storeuserd"
  "$HOME/Library/com.apple.spotlight/SpotlightHelper"
  "$HOME/Library/Dock/com.apple.dock.cache"
  "$HOME/Library/Skype/SkypeHelper"
  "$HOME/Library/Dropbox/DropboxCache"
  "$HOME/Library/Google/Chrome/nacld"
  "$HOME/Library/Firefox/Profiles/profiled"
)
echo 'Suspicious files:'
for loc in "${locations[@]}"; do
  /bin/test -f "$loc" && echo "$loc"
done || echo '(none)'
echo 'Suspicious connections:'
/usr/sbin/lsof -i | /usr/bin/grep  -e 158.69.241 -e jikenick12and67 -e cameforcameand33212 || echo '(none)'

Thank you! One remark: these directories are usually in $HOME/Library/Application\ Support, not in$HOME/Library Are we sure that securelist has the correct paths?