• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   Mac   »   Windows App Runs on Mac, Downloads Info Stealer and Adware

Windows App Runs on Mac, Downloads Info Stealer and Adware

  • Posted on:February 11, 2019 at 5:07 am
  • Posted in:Mac, Malware
  • Author:
    Trend Micro
0

Update as of 5:00 P.M. PST, February 18, 2019: Further analysis on the sample indicated that it does not bypass the Gatekeeper mechanism as previously reported. We made the necessary changes in the technical analysis in this post. We would also like to thank Apple Product Security team for reaching out to us to clarify this issue.

By Don Ladores and Luis Magisa

EXE is the official executable file format used for Windows to signify that they only run on Windows platforms, and to serve as a security feature. By default, attempting to run an EXE file on a Mac or Linux OS will only show an error notification.

However, we found EXE files in the wild delivering malicious payload on macOS recently. While no specific attack pattern is seen, our telemetry showed the highest numbers for infections to be in the United Kingdom, Australia, Armenia, Luxembourg, South Africa, and the United States.

Behavior

The sample we examined is an installer of a popular firewall app for Mac and Windows called Little Snitch, available for download from various torrent websites. Names of the .NET compiled Windows executable are as follows:

  • Paragon_NTFS_for_Mac_OS_Sierra_Fully_Activated.zip
  • Wondershare_Filmora_924_Patched_Mac_OSX_X.zip
  • LennarDigital_Sylenth1_VSTi_AU_v3_203_MAC_OSX.zip
  • Sylenth1_v331_Purple_Skin__Sound_Radix_32Lives_v109.zip
  • TORRENTINSTANT.COM+-+Traktor_Pro_2_for_MAC_v321.zip
  • Little_Snitch_583_MAC_OS_X.zip

When the downloaded .ZIP file is extracted, it contains a .DMG file hosting the installer for Little Snitch.

Figure 1. Sample of file contained from extracted Windows executable.

Figure 2. Installer of Little Snitch contained in the .DMG sample we analyzed.

Inspecting the installer contents, we found the unusual presence of the .EXE file bundled inside the app, verified to be a Windows executable responsible for the malicious payload.

Figure 3. Suspicious .EXE bundled for Mac app installer.

When the installer is executed, the main file also launched the executable as it is enabled by the mono framework included in the bundle. This framework allows the execution of Microsoft .NET applications across platforms such as OSX.

Once run, the malware collects the following system information:

  • ModelName
  • ModelIdentifier
  • ProcessorSpeed
  • ProcessorDetails
  • NumberofProcessors
  • NumberofCores
  • Memory
  • BootROMVersion
  • SMCVersion
  • SerialNumber
  • UUID

Under the /Application directory, the malware also scans for all the basic and installed apps and sends all the information to the C&C server:

  • App Store.app
  • Automator.app
  • Calculator.app
  • Calendar.app
  • Chess.app
  • Contacts.app
  • DVD Player.app
  • Dashboard.app
  • FaceTime.app
  • Font Book.app
  • Image Capture.app
  • iTunes.app
  • Launchpad.app
  • Mail.app
  • Maps.app
  • Messages.app
  • Mission Control.app
  • Notes.app
  • Photo Booth.app
  • Photos.app
  • Preview.app
  • QuickTime Player.app
  • Reminders.app
  • Safari.app
  • Siri.app
  • Stickies.app
  • System Preferences.app
  • TextEdit.app
  • Time Machine.app
  • UtilitiesiBooks.app

It downloads the following files from the Internet and saves it to the directory ~/Library/X2441139MAC/Temp/:

  • hxxp://install.osxappdownload.com/download/mcwnet
  • hxxp://reiteration-a.akamaihd.net/INSREZBHAZUIKGLAASDZFAHUYDWNBYTRWMFSOGZQNJYCAP/FlashPlayer.dmg
  • hxxp://cdn.macapproduct.com/installer/macsearch.dmg

Figure 4. Downloaded files saved in the directory.

These .DMG files are mounted and executed as soon as they are ready, as well as displaying a PUA during execution.

Figure 5. One of the adwares downloaded posing as a popular app.

Figure 6. One of the PUAs displayed when the file is run.

This malware runs specifically to target Mac users. Attempting to run the sample in Windows displays an error notification.

Figure 7. Error notification when installer is executed in Windows.

Currently, running EXE on other platforms would have no impact on non-Windows systems such as MacOS. A mono framework installed in the system is required to compile or load these executables and libraries. In this case, however, the bundling of the said framework with the malicious files becomes a workaround to enable EXE files to run on Mac systems. As for the native library differences between Windows and MacOS, the mono framework supports DLL mapping to support Windows-only dependencies to their MacOS counterparts. Overall, this technique may be done to overcome a malicious user’s Objective-c coding limitations.

Conclusion

We suspect that this specific malware can be used for future inter-platform attacks, where a single executable can perform its payload on different operating systems. We believe that the cybercriminals are still studying the development and opportunities from this malware bundled in apps and available in torrent sites. We will continue investigating how cybercriminals can use this information and routine. Users should avoid or refrain from downloading files, programs, and software from unverified sources and websites, and install a multi-layered protection for their individual and enterprise systems.

Trend Micro Solutions

The following Trend Micro products detect and block this threat:

Trend Micro Antivirus for Mac

Trend Micro Smart Protection Suites

Indicators of Compromise

Main Executables

File

SHA256

Detection

setup.dmg

c87d858c476f8fa9ac5b5f68c48dff8efe3cee4d24ab11aebeec7066b55cbc53 TrojanSpy.MacOS.Winplyer.A

Installer.exe

932d6adbc6a2d8aa5ead5f7206511789276e24c37100283926bd2ce61e840045 TrojanSpy.Win32.Winplyer.A

OSX64_MACSEARCH.MSGL517

58cba382d3e923e450321704eb9b09f4a6be008189a30c37eca8ed42f2fa77af Adware.MacOS.MacSearch.A

chs2

3cbb3e61bf74726ec4c0d2b972dd063ff126b86d930f90f48f1308736cf4db3e Adware.MacOS.GENIEO.AB

Installer (2)

e13c9ab5060061ad2e693f34279c1b1390e6977a404041178025373a7c7ed08a Adware.MacOS.GENIEO.AB

macsearch

b31bf0da3ad7cbd92ec3e7cfe6501bea2508c3915827a70b27e9b47ffa89c52e Adware.MacOS.MacSearch.B
C&C server
hxxp://54.164.144.252:10000/loadPE/getOffers.php

Related posts:

  • Maikspy Spyware Poses as Adult Game, Targets Windows and Android Users
  • Malware Targeting Brazil Uses Legitimate Windows Components WMI and CertUtil as Part of its Routine
  • Perl-Based Shellbot Looks to Target Organizations via C&C
  • Adware Disguised as Game, TV, Remote Control Apps Infect 9 Million Google Play Users
Learn how to protect Enterprises, Small Businesses, and Home Users from ransomware:
ENTERPRISE »
SMALL BUSINESS»
HOME»
Tags: adwareappEXEGatekeeperinfo stealerWindows

Featured Stories

  • systemd Vulnerability Leads to Denial of Service on Linux
  • qkG Filecoder: Self-Replicating, Document-Encrypting Ransomware
  • Mitigating CVE-2017-5689, an Intel Management Engine Vulnerability
  • A Closer Look at North Korea’s Internet
  • From Cybercrime to Cyberpropaganda

Security Predictions for 2019

  • Our security predictions for 2019 are based on our experts’ analysis of the progress of current and emerging technologies, user behavior, and market trends, and their impact on the threat landscape. We have categorized them according to the main areas that are likely to be affected, given the sprawling nature of the technological and sociopolitical changes under consideration.
    Read our security predictions for 2019.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Recent Posts

  • Monero Miner-Malware Uses RADMIN, MIMIKATZ to Infect, Propagate via Vulnerability
  • February Patch Tuesday: Batch Includes 77 Updates That Cover Flaws in Internet Explorer, Exchange Server, and DHCP Server
  • Trickbot Adds Remote Application Credential-Grabbing Capabilities to Its Repertoire
  • Windows App Runs on Mac, Downloads Info Stealer and Adware
  • Linux Coin Miner Copied Scripts From KORKERDS, Removes All Other Malware and Miners

Popular Posts

  • Going In-depth with Emotet: Multilayer Operating Mechanisms
  • February Patch Tuesday: Batch Includes 77 Updates That Cover Flaws in Internet Explorer, Exchange Server, and DHCP Server
  • Various Google Play ‘Beauty Camera’ Apps Send Users Pornographic Content, Redirect Them to Phishing Websites and Collect Their Pictures
  • Trickbot Adds Remote Application Credential-Grabbing Capabilities to Its Repertoire
  • Linux Coin Miner Copied Scripts From KORKERDS, Removes All Other Malware and Miners

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.