r/Malware • u/b0h1 • 1d ago

fake homebrew

/r/computerviruses/comments/1x56f0j/fake_homebrew/
0 Upvotes

50% Upvoted

7 comments sorted by

1

u/LightningRurik 1d ago

I'm kinda interested just based on the title.

Can you upload to Virustotal.com and give the URL?

1

u/b0h1 1d ago

https://www.virustotal.com/gui/file/486277d29cbefcbd321d7c7ad5d72bf1983c110206ed607c6c371af7f7741308/behavior

1

u/LightningRurik 20h ago

The original post was deleted. What was the context?

Was this a fake brew cask? A command line given on a spam page to copy and paste into terminal to install?

1

u/b0h1 20h ago

Original post was that I ran it but didn’t put the admin password in. Question am I cooked or not. It seems I’m okay but not sure. Reinstalled

1

u/LightningRurik 19h ago

Potentially cooked.

It's likely AMOS, an infostealer (https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/). That's also seen in its behavior:

https://www.virustotal.com/gui/file/486277d29cbefcbd321d7c7ad5d72bf1983c110206ed607c6c371af7f7741308/behavior

It's trying to get your ssh keys, cloud account configs, etc.

It needs admin privileges to run fully, so if you didn't type in your password there is likelihood that it didn't run. If you're unsure, and still have access to original files, you could see if those /tmp/ files were ever created. Virustotal tells you what to expect, and you can verify how much actually happened.

1

u/b0h1 19h ago

I investigated based on virustotal, and it seems it didn’t have time to run properly. 30sec