MacKeeper Bundlore Apr 2019

Bundlore has obfuscated data with base64, AES, RC4, and bz2.

Bundlore has disguised a malicious .app file as a Flash Player update.

Bundlore prompts the user for their credentials.

Bundlore has used the ps command to list processes.

Bundlore can use AppleScript to inject malicious JavaScript into a browser.

Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.

Bundlore has used Python scripts to execute payloads.

Bundlore can execute JavaScript by injecting it into the victim's browser.

Bundlore uses HTTP requests for C2.

Bundlore will enumerate the macOS version to determine which follow-on behaviors to execute using /usr/bin/sw_vers -productVersion.

Bundlore creates a new key pair with ssh-keygen and drops the newly created user key in authorized_keys to enable remote login.

Bundlore can download and execute new versions of itself.

Bundlore has used openssl to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.

Bundlore can install malicious browser extensions that are used to hijack user searches.

Bundlore has been spread through malicious advertisements on websites.

Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update.

Bundlore has the ability to enumerate what browser is being used as well as version information for Safari.

Bundlore can persist via a LaunchAgent.

Bundlore can persist via a LaunchDaemon.

Bundlore can change browser security settings to enable extensions to be installed. Bundlore uses the pkill cfprefsd command to prevent users from inspecting processes.