download videos from facebook without adware malware for mac

#Download videos from facebook without adware malware for mac install#
#Download videos from facebook without adware malware for mac zip file#
#Download videos from facebook without adware malware for mac code#

These disk images are recognized by SentinelOne agent as malicious and are either blocked or alerted on-write (depending on the site admin policy) Īmong the claims that InstallVibes makes on their (insecure http) website are that they provide a “branded installer” service to optimize downloads and pay-per-install (PPI) software.Īt the time of writing, there are two variants of flashinstaller on VirusTotal: Looking at the hidden application plist reveals that it’s actually an installer from a well-known PPI provider, InstallVibes.

So much for the installer, but what does this malware actually do? The previous researchers suggested that it was related to Shlayer and Bundlore and noted that the hidden application was a downloader for “Mac malware or adware”. Decompressed App Is InstallVibes Bundle Installer

#Download videos from facebook without adware malware for mac zip file#

The resulting decompressed zip file produces an application bundle in the temp directory described earlier called, descriptively enough, “Installer.app”.

The man page for funzip also states “funzip is most useful in conjunction with a secondary archiver program such as tar(1)”.Īnd this is exactly what the malware does: tail +$((LINENO+4)) $0 | funzip -9D956F55-1964-48A9-8DDE-7F7618E1D3D1 | tar -C $TEMP_DIR -p -xf.

#Download videos from facebook without adware malware for mac code#

The LINENO+4 code simply moves the reference to line 7 (current line +4) of the script – the beginning of the embedded and compressed zip file – and pipes this embedded code into the funzip utility. It’s not the first time we’ve seen the POSIX built-in LINENO variable used in these kind of installer scripts, but it is the first time we’ve come across the use of the funzip utility. Line 3 of the script is perhaps the most interesting. Read Now Unpacking the Embedded Installer.app While presence of the nohup.out file is perfectly normal, threat hunters noticing the sudden or unexpected appearance of this file can use it as a possible indicator for this malware and ensure they check for the $TMPDIR/x./ folder and other IOCs (detailed below). However, nohup has a nice side-effect when called from non-writable disk like a DMG: it leaves a log file in the User’s $HOME directory, nohup.out. This tool is used to invoke a process that is immune from hangups.

The Darwin_User_Temp_Dir folder can also be accessed via the $TMPDIR environment variable.Ī second giveaway helpful for macOS threat hunters is also provided by the use of the nohup utility at Line 5. This offers a nice clue for defenders and detection algorithms, as that combination of options means the malware will always create a temporary folder in Darwin_User_Temp_Dir with the prefix x followed by a random character string. Note that in the form used in this sample, however, there is use of the -t switch followed by the character x. The shell script commands are worth pausing over to understand how this installer works.Īs we noted recently, mktemp is widely used in script-based, macOS malware to create randomly named paths to help them evade simple detection heuristics. Opening the flashinstaller file in a text editor reveals its contents.

Inspecting the disk image shows that it does not contain an application bundle but rather a shell script with an Adobe Flash icon. The earlier research showed that this malware was being propagated via a DMG disk image containing a shell script, which itself contained a compressed application bundle.

#Download videos from facebook without adware malware for mac install#

However, there are a few interesting characteristics in these new samples that Intego didn’t cover in their post and which we felt were worth a closer look.įrom our analysis, it appears that this malware is a dropper for VindInstaller.B adware, which adopts the increasingly-common technique of using a shell script to install known malware and evade detection by legacy AV and signature-based security solutions.Ī Malicious Shell-Script with Helpful IoCs The details provided by the researchers were strikingly similar to other script-based malware that we’ve posted about before. After this year’s action-packed WWDC 2020, it’s time to catch up with developments in macOS malware! Just prior to Apple’s big event, researchers at Intego posted details of what they called a “new macOS malware” they had seen being delivered to unwitting victims through Google searches.