This script installs the following components of the malware: /Library/Scripts/queue That process, in turn, executes an included shell script named install.sh: #!/bin/shĬp -f '$/Install Adobe Flash Player' When the app runs, a malicious executable named Install – also code-signed by Addy Symonds – runs first. The app has a rather strange internal structure, lacking the normal structure of an application bundle on macOS. It turns out that this is because the app incorporates a real Flash installer. This is a significant break from other fake Flash installers, which at best download the real Flash installer and open it separately after proceeding through a completely unconvincing fake install process. Proceeding through the installation to the end will display no suspicious behavior and in the end, Flash will actually be installed. If such a password is provided, the behavior continues to be consistent with the real thing. If the app is opened, it will immediately ask for an admin user password, which is typical behavior for a real Flash installer. The app is signed, however, by a certificate issued to an “Addy Symonds” rather than Adobe, but the average user is never going to know that… as long as it’s signed, Apple’s Gatekeeper system will allow it, when set to its default settings. zip file would appear to be a legit Adobe Flash Player installer. The malware was found in a file named Install Adobe Flash. (I mean, come on, there are other pieces of software out there! Why are the bad guys so hung up on Flash installers?) Distribution method

It’s not known at this point how Snake is spread, although the fact that it imitates an Adobe Flash Player installer suggests a not-very-sophisticated method. Now, it appears to have been ported to Mac.įox-IT International wrote about the discovery of a Mac version of Snake on Tuesday. It was even seen infecting Linux systems in 2014. It is thought to be Russian governmental malware and on Windows is highly-sophisticated. Snake, also known as Turla and Uroburos, is backdoor malware that has been around and infecting Windows systems since at least 2008.

Malwarebytes will not install 2017