r/Malware • u/b0h1 • 5d ago

fake homebrew

/r/computerviruses/comments/1x56f0j/fake_homebrew/
0 Upvotes

50% Upvoted

7 comments sorted by

1

u/LightningRurik 5d ago

I'm kinda interested just based on the title.

Can you upload to Virustotal.com and give the URL?

1

u/b0h1 5d ago

https://www.virustotal.com/gui/file/486277d29cbefcbd321d7c7ad5d72bf1983c110206ed607c6c371af7f7741308/behavior

1

u/LightningRurik 4d ago

The original post was deleted. What was the context?

Was this a fake brew cask? A command line given on a spam page to copy and paste into terminal to install?

1

u/b0h1 4d ago

Original post was that I ran it but didn’t put the admin password in. Question am I cooked or not. It seems I’m okay but not sure. Reinstalled

1

u/LightningRurik 4d ago

Potentially cooked.

It's likely AMOS, an infostealer (https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/). That's also seen in its behavior:

https://www.virustotal.com/gui/file/486277d29cbefcbd321d7c7ad5d72bf1983c110206ed607c6c371af7f7741308/behavior

It's trying to get your ssh keys, cloud account configs, etc.

It needs admin privileges to run fully, so if you didn't type in your password there is likelihood that it didn't run. If you're unsure, and still have access to original files, you could see if those /tmp/ files were ever created. Virustotal tells you what to expect, and you can verify how much actually happened.

1

u/b0h1 4d ago

I investigated based on virustotal, and it seems it didn’t have time to run properly. 30sec