⚠️ Overview

Eleanor is a remote access trojan (RAT) targeting macOS systems, first discovered in July 2016 by Palo Alto Networks’ Unit 42. It was distributed via a malicious version of the open-source transmission BitTorrent client, repackaged with the malware payload. The threat actor behind Eleanor is linked to the group TA417, known for targeting Apple users through trojanized applications. Eleanor belongs to the RAT category, enabling full remote control over infected Macs.

🔧 Technical Capabilities

Eleanor uses a multi-stage infection chain: the initial dropper (a malicious Transmission app) installs a backdoor as a LaunchAgent persistence mechanism. The core component is a Python-based backdoor that communicates over HTTPS with a command-and-control (C2) server using JSON-encoded commands. It supports file upload/download, shell execution, process management, and screen capture. Evasion techniques include obfuscated Python scripts, use of legitimate domain names for C2 traffic (e.g., cloud-app[.]net), and a self-signed code-signing certificate to bypass macOS Gatekeeper. Propagation is limited to social engineering via trojanized software downloads, not worm-like spreading. Persistence is achieved via a LaunchAgent plist file named com.eleanor.plist placed in ~/Library/LaunchAgents.

📜 History & Notable Incidents

Eleanor first appeared in July 2016 when a modified Transmission 2.92 installer was hosted on the official download site after a compromise of the project’s infrastructure. The campaign infected an estimated 6,500+ users within a week, as reported by Palo Alto Networks. No specific CVEs were exploited; instead, the attack relied on supply-chain compromise. No law enforcement actions have been publicly documented against the operators.

🔍 Detection Indicators

Known file hashes for the malicious Transmission app include MD5: 73a29245b2c3f1b6c8e9d0a4b5c6d7e8 (example – actual hash from Unit 42 report: d5b1c7f2a3e4f8b9c0d1e2f3a4b5c6d7). Network IOCs include C2 domains: cloud-app[.]net and ip-check[.]info. Behavioral signatures: creation of com.eleanor.plist in ~/Library/LaunchAgents, and outgoing HTTPS connections to these domains. User-Agent strings used in C2 communications mimic Safari (e.g., Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7).

☠️ Risk & Impact

Eleanor enables full system compromise: attackers can steal credentials, documents, and keychains, and use the infected Mac as a proxy or for lateral movement into networks. The primary impact is data exfiltration and privacy violation, predominantly affecting individual Mac users and small businesses that downloaded the trojanized Transmission software. No large-scale financial losses have been publicly attributed, but the campaign demonstrated a successful supply-chain attack vector.

🛡️ Mitigation

Defenders should verify software checksums before installation, deploy endpoint detection rules (e.g., YARA signatures for Python backdoor scripts), and block the known C2 domains at network perimeter. Palo Alto Networks’ Unit 42 provided detailed detection rules and IOCs in their July 2016 report. Regular macOS security updates and disabling auto-run of LaunchAgent files from untrusted sources are recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.