![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23085712/abstract-complucter-990x400.jpg) For close to two years now, the Shlayer Trojan has been the most common threat on the macOS platform: in 2019, one in ten of our Mac security solutions encountered this malware at least once, and it accounts for almost 30% of all detections for this OS. The first specimens of this family fell into our hands back in February 2018, and we have since collected almost 32,000 different malicious samples of the Trojan and identified 143 C&C server domains. _TOP 10 threats for macOS by share of users attacked, as detected by Kaspersky security solutions for macOS, January– November 2019_[ (download)]() The operation algorithm has changed little since Shlayer was first discovered, nor has its activity decreased much: the number of detections remains at the same level as in the first months after the malware was uncovered. _Shlayer malware detections by Kaspersky security solutions for macOS, February 2018 – November 2019_[ (download)]() ## Technical details Despite its prevalence, from a technical viewpoint Shlayer is a rather ordinary piece of malware. Of all its modifications, only the recent Trojan-Downloader.OSX.Shlayer.e stands apart. Unlike its Bash-based cousins, this variant of the malware is written in Python, and its operation algorithm is also somewhat different. Let's demonstrate this using a DMG file with MD5 4d86ae25913374cfcb80a8d798b9016e. ### First stage of infection After mounting this DMG image, the user is prompted to run an "installation" file. However, the seemingly standard installer turns out to be a Python script, which is already atypical of macOS installation software. [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082602/shlayer-for-macos-3.png)]() _Shlayer user guide_ The directory with executable files inside the application package contains two Python scripts: gjpWvvuUD847DzQPyBI (main) and goQWAJdbnuv6 (auxiliary). The latter implements data encryption functions by means of a byte shift on the **key** key: * The** encryptText**/**decryptText** pair of functions encrypt and decrypt strings; * **encryptList** encrypts the contents of the list passed in the arguments; **decryptList** performs the inverse operation; * The **getKey()** function generates an encryption key based on the time in the operating system. [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082606/shlayer-for-macos-4.png)]() _Main script of the Trojan_ [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082610/shlayer-for-macos-5.png)]() _Auxiliary script of the Trojan_ Next, the main script generates a unique user and system ID, and also collects information about the version of macOS in use. Based on this data, the GET query parameters are generated to download the ZIP file: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082614/shlayer-for-macos-6.png)]() The ZIP archive downloaded to the **/tmp/%(sessionID)** directory is unpacked to the **/tmp/tmp** directory using the unzip function: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082619/shlayer-for-macos-7.png)]() The ZIP archive was found to contain an application package with the executable file 84cd5bba3870: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082623/shlayer-for-macos-8.png)]() After unpacking the archive, the main python script uses the **chmod** tool to assign the file 84cd5bba3870 permission to run in the system: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082626/shlayer-for-macos-9.png)]() For added effect, the sample copies the icon of the original mounted DMG image to the directory with the newly downloaded application package using the **moveIcon** and **findVolumePath** functions: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082630/shlayer-for-macos-10.png)]() After that, the Trojan runs the downloaded and unpacked application package using the built-in **open** tool, and deletes the downloaded archive and its unpacked contents: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082634/shlayer-for-macos-11.png)]() ### Second stage of infection Shlayer itself performs only the initial stage of the attack — it penetrates the system, loads the main payload, and runs it. The negative consequences for the user can be seen by investigating the AdWare.OSX.Cimpli family, which was being actively downloaded by the Trojan at the time of writing. At first glance, the Cimpli installer looks harmless enough, simply offering to install a partner application (for example, Any Search): [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082638/shlayer-for-macos-12.png)]() But in actual fact, Cimpli performs several actions unseen by the user. First, it installs a malicious extension in Safari, hiding the OS security notification behind a malware fake window. By clicking on the buttons in the notification, the user in effect agrees to install the extension. [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082642/shlayer-for-macos-13.png)]() _Left: what the user sees; right: what's really going on_ One of these extensions is called ManagementMark, which we detect as not-a-virus:HEUR:AdWare.Script.SearchExt.gen. It monitors user searches and redirects them to the address hxxp://lkysearchex41343-a.akamaihd[.]net/as?q=c by injecting the script **script.js** in the browser pages: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082647/shlayer-for-macos-14.png)]() The sample also loads the **mitmdump** tool, which is packed using PyInstaller. To allow mitmdump to view HTTPS traffic, a special trusted certificate is added to the system. This is likewise done by superimposing a fake window over the installation confirmation box. After that, all user traffic is redirected to the SOCKS5 proxy launched using mitmdump. [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082651/shlayer-for-macos-15.png)]() _Arguments for running the packed mitmdump run arguments_ From the screenshot, it can be seen that all traffic passing through mitmdump (**SearchSkilledData**) is processed by the script **SearchSkilledData.py** (**-s** option): [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082656/shlayer-for-macos-16.png)]() This script redirects all user search queries to hxxp://lkysearchds3822-a.akamaihd[.]net. Kaspersky solutions detect this script as not-a-virus:AdWare.Python.CimpliAds.a. Cimpli adware thus becomes firmly anchored in the system; in the event that traffic does not pass through the proxy server, the JS code of the extension injected in the page handles the redirection of queries. The attacker gains access to the user's search queries and can modify the search engine results to display advertising. As a result, the user is inundated with unsolicited ads. Note that Cimpli is not the only family of adware apps that Shlayer can download. The list also includes AdWare.OSX.Bnodlero, AdWare.OSX.Geonei, and AdWare.OSX.Pirrit, which made up almost all the remaining positions in the Top 10 threats for macOS in 2019. ## Family ties The behavioral similarities between the Python version of Shlayer and earlier modifications of the family [written in Bash]() are not hard to spot: harvesting IDs and system versions, downloading an archive to a temporary directory, executing the downloaded file, deleting traces of downloading — we've seen this course of actions before. Moreover, both modifications use **curl** with the combination of options **-f0L**, which is basically the calling card of the entire family: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082700/shlayer-for-macos-17.png)]() [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082704/shlayer-for-macos-18.png)]() _Top: an old modification of the Trojan; bottom: the latest version_ [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082708/shlayer-for-macos-19.png)]() _Finding legitimate use for **curl** with options –**f0L** is not an easy task_ ## Distribution Distribution is a vital part of any malware's life cycle, and the creators of Shlayer have taken this issue to heart. Looking for the latest episode of your favorite TV show? Want to watch a live broadcast of a soccer match? Then take extra care, since the chances of a run-in with Shlayer are high. [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082713/shlayer-for-macos-20.png)]() [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082718/shlayer-for-macos-21.png)]() _Examples of Shlayer landing pages_ We noticed at once several [file partner programs]() in which Shlayer was offered as a monetization tool. Having analyzed various offers, we identified a general trend: Shlayer stands out from the field for the relatively high installation fee (though only installations performed by U.S.-based users count). The prospect of a juicy profit likely contributed to the popularity of the offer (we counted more than 1000 partner sites distributing Shlayer). [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082723/shlayer-for-macos-22.png)]() _Description of the offer on a partner program website_ In most cases, it was advertising landing pages that brought users to the next stage of the distribution chain — nicely crafted fake pages prompting to install the malware under the veil of a Flash Player update. This is primarily how the Trojan-Downloader.OSX.Shlayer.a modification was distributed. [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082729/shlayer-for-macos-23.png)]() _Fake Flash Player download page_ The version of Trojan-Downloader.OSX.Shlayer.e discussed above was propagated in a slightly different way. Similar to the previous scheme, users ended up on a page seemingly offering an Adobe Flash update. But they were redirected there from large online services boasting a multimillion-dollar audience. Time and again, we have uncovered links pointing to malware downloads in the descriptions of YouTube videos: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082734/shlayer-for-macos-24.png)]() Another example is links to Shlayer distribution pages contained in the footnotes to Wikipedia articles: [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/01/23082738/shlayer-for-macos-25.png)]() These links were not added by the cybercriminals themselves: we found that all those malicious domains had recently expired, and, judging by the WHOIS data, they now belong to a single individual. On the websites, the newly minted owner posted a malicious script that redirects users to Shlayer download landing pages. There are already over 700 such domains in total. Our statistics show that the majority of Shlayer attacks are against users in the U.S. (31%), followed by Germany (14%), France (10%), and the UK (10%). This is wholly consistent with the terms and conditions of partner programs that deliver the malware, and with the fact that almost all sites with fake Flash Player download pages had English-language content. _Geographic distribution of users attacked by the Shlayer Trojan, February 2018 – October 2019_[ (download)]() ## Conclusion Having studied the Shlayer family, we can conclude that the macOS platform is a good source of revenue for cybercriminals. The Trojan links even reside on legitimate resources — attackers are adept in the art of social engineering, and it is hard to predict how sophisticated the next deception technique will be. Kaspersky solutions detect Shlayer and its artifacts and download pages with the following verdicts: * HEUR:Trojan-Downloader.OSX.Shlayer.* * not-a-virus:HEUR:AdWare.OSX.Cimpli.* * not-a-virus:AdWare.Script.SearchExt.* * not-a-virus:AdWare.Python.CimpliAds.* * not-a-virus:HEUR:AdWare.Script.MacGenerator.gen **IOCS:** * 4d86ae25913374cfcb80a8d798b9016e * fa124ed3905a9075517f497531779f92 * 594aa050742406db04a8e07b5d247cdd **Malicious links:** * hxxp://80.82.77.84/.dmg * hxxp://sci-hub[.]tv * hxxp://kodak-world[.]com **C&C Urls:** * hxxp://api.typicalarchive[.]com * hxxp://api.entrycache[.]com * hxxp://api.macsmoments[.]com

Query Builder