Adware.Mac.WeDownload.1

A downloader of affiliate software for OS X that has the following digital signature: "Developer ID Application: Simon Max (GW6F4C87KX)". The build folder path is as follows:

/Users/bogdancarmanus/Sites/download-manager-mac/DownloadManager/

The structure of the DMG image looks as follows:

Installer.app
.app

where ".app" indicates the configuration file encoded in base64 (the output string is encoded in utf-8) and encrypted with the RC4 algorithm. The configuration file can look as follows:

{
    "program_name": "Adobe Flash Player",
    "mirrors": ["http:\/\/fpdownload.macromedia.com\/get\/flashplayer\/pdc\/17.0.0.134\/install_flash_player_osx.dmg"],
    "api_key": "046073b03739711e23d9c307b94707b46e435467",
    "icon_url": "https:\/\/d1sx0cjuasqkw9.cloudfront.net\/installer-icons\/245\/046073b03739711e23d9c307b94707b46e435467.jpeg",
    "properties": {
        "program_name": "Adobe Flash Player",
        "prg": "7ltLcPzz_KAYIbT3rB0-wLaIytmcWoShM2U8I3yo8_K9HZfdYtzMPGsr4imyRhHz_MQa1mykPxKIf1OZ4HfsmUrhD4wsWABUbUrtKgiTptiN46xVxTRxO6ZW5epAVQl3vCYBUWhG_GN7KvVhQEyviVYYOUlcHA0pb7gRcN_E08HfrecprCGvemEb4xHF29ko9qshW2F4VDpEUS4b-wDBZPVm7owfXLNbrn35mKh5vrrOE2rs4IpBpje6XO_XGLGs"
    },
    "download_manager_identifier": 1442281855,
    "license": "",
    "version": "",
    "size": "",
    "file_name": "Adobe_Flash_Player.dmg",
    "disable_root": "false",
    "browser": "Google Chrome"
}

Once launched, Adware.Mac.WeDownload.1 prompts the user to grant it administrator privileges and sends consecutive requests to three command and control servers, whose addresses are hard coded in its body, to get data for the main application window. If none of the servers responds, the downloader terminates its work.

If Adware.Mac.WeDownload.1 gets a response, it sends the command and control server a POST request containing the downloader's configuration data in JSON format (JavaScript Object Notation). As a reply, the program receives an HTML page with the contents of the main window. The downloader adds a current time mark and a digital signature to all future GET and POST requests. The signature looks as follows:

s=<len>-<hash>r

where len indicates the length of signed data, hash indicates the hash of HMAC_SHA256 encrypted with the key that is hard coded in the program's body. Then the downloader sends the remote server a request for the list of files:

GET /eligibility.php?api_key=046073b03739711e23d9c307b94707b46e435467&os=mac&properties[program_name]=Adobe%20Flash%20Player&properties[prg]=7ltLcPzz_KAYIbT3rB0-wLaIytmcWoShM2U8I3yo8_K9HZfdYtzMPGsr4imyRhHz_MQa1mykPxKIf1OZ4HfsmUrhD4wsWABUbUrtKgiTptiN46xVxTRxO6ZW5epAVQl3vCYBUWhG_GN7KvVhQEyviVYYOUlcHA0pb7gRcN_E08HfrecprCGvemEb4xHF29ko9qshW2F4VDpEUS4b-wDBZPVm7owfXLNbrn35mKh5vrrOE2rs4IpBpje6XO_XGLGs&dl_id=1442281855&browser=Safari&os_version=10.9&t=1442327369&s=454-11a7d7d9739c3d34991058e8b3f8f4a999634ab6fe6614754be301520c74226br HTTP/1.1
Host: api.xtrdlapi.com
Referer: http://api.xtrdlapi.com/interface/mac/?v=4
Accept-Encoding: gzip, deflate
Accept: application/json, text/plain, */*
Accept-Language: en-us
Connection: keep-alive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.78.2 (KHTML, like Gecko)

where api_key, dl_id, properties[program_name], and properties[prg] indicate parameters from the configuration file, browser indicates the default browser, and os_version indicates the OS version.

The server replies with a data block in JSON format (JavaScript Object Notation) containing the list of applications to be installed. The list can contain the following programs:

• MacKeeper (Program.Unwanted.MacKeeper)
• Crossrider (Mac.Trojan.Crossrider)
• Genieo (Mac.Trojan.Genieo)
• Conduit (Trojan.Conduit)
• Advanced Mac Cleaner (Program.Mac.Unwanted.AMC)
• Yahoo Search (the default search engine is changed to Yahoo with the partner's ID)
• ZipCloud (Program.Mac.Unwanted.ZipCloud)
• MacBooster (Program.Unwanted.MacBooster)
• TuneUpMyMac (Program.Unwanted.TuneUpMymac)
• PremierOpinion (Mac.BackDoor.OpinionSpy)
• InstallCore (Adware.Mac.InstallCore)

The total number and types of programs depend on the victim's geolocation. If the list of applications is empty, the user will not be offered to install anything else except for their original choice.

News about this downloader