Your browser is obsolete!

The page may not load correctly.

Free trial
Dr.Web for Android

Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support

Send a message

Call us

+7 (495) 789-45-86

Forum
Profile

Back to news

Adware for OS X distributes Trojans

June 22, 2015

Lately, reports about distribution of new malicious and potentially dangerous programs for OS X have been emerging with great frequency. Doctor Web security researches have registered a growing number of various adware and installers for Apple computers, which is related, to a large extent, to appearance of new affiliate programs aimed at OS X users. It is one of such programs that has been used by cybercriminals to spread Trojans of the Trojan.Crossrider family.

An installer of unwanted applications that has been added to Dr.Web virus database as Adware.Mac.MacInst.1 is created using resources of an affiliate program called “macdownloadpro.com”. Websites of numerous “partners” taking part in this program are usually packed with different advertising modules, and visiting such webpages leads to multiple tabs being open in the browser window. The installer itself is disguised as a “useful” application or an MP3 file. In some cases, the installer is downloaded automatically while the user is redirected to a specific webpage.

The image of Adware.Mac.MacInst.1 has a rather remarkable structure; that is, it contains two hidden folders that cannot be viewed on the computer running with standard operating system settings if the user decides to browse the contents of the DMG file using Finder.

The directory with the application contains a binary file that launches the installer and another folder with the logo of the application and the encrypted configuration file. Once the installer is run, it demonstrates a dialogue window with the information on the file the user wanted to download.

screen

After the “Next” button is clicked, the malware displays a partnership agreement informing the user that in addition to the file itself some other components will be installed.

screen

If the user clicks the hardly visible “Decline” link at the bottom of the window, only the initially chosen file will be downloaded. However, if the “Next” button is clicked, together with the file, the program detected by Dr.Web as Trojan.Vindinstaller.3 will be downloaded and run.

This application, in turn, installs malicious plugins for Safari, Firefox, and Chrome. These extensions are detected as Trojans belonging to the Trojan.Crossrider family. Adware.Mac.MacInst.1 copies all downloaded components into the “~/Library/Application Support/osxDownloader” folder.

screen

screen

screen

Signatures of these malicious programs have been added to Dr.Web virus databases for OS X. Therefore, they pose no threat to our users.

Tell us what you think

You will be awarded one Dr.Webling per comment. To ask Doctor Web’s site administration about a news item, enter @admin at the beginning of your comment. If your question is for the author of one of the comments, put @ before their names.


Other comments

The Russian developer of Dr.Web anti-viruses

Doctor Web has been developing anti-virus software since 1992

Dr.Web is trusted by users around the world in 200+ countries

The company has delivered an anti-virus as a service since 2007

24/7 tech support

© Doctor Web
2003 — 2017

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125040