For Mac Users: Beware! New Adware Makes It Easier to Distribute Trojans
Adware.Mac.WeDownload.1 an entry point for more serious malware infections on Macs, usually Trojans. A new piece of adware that serves as an entry point for future Trojan infections has been discovered by Dr.Web security researchers.
This new malware was named Adware.Mac.WeDownload.1 because it was first detected on the WeDownload.com domain, bundled with a modified version of Adobe Flash Player.
According to what Dr.Web researchers discovered, the 'package' was signed with “Developer ID Application: Simon Max (GW6F4C87KX)” and was actively distributed as part of a shady affiliate program in which developers are rewarded based on the number of files downloaded.
Taking a closer look at the file, researchers found that, once double-clicked, the adware will first require administrator privileges on the infected computer in order to install the Flash Player package.
If granted, it will then initiate communications with a C&C server whose address is hard-coded in its source code, obtaining the information needed to convince the user to install all kinds of malicious applications on their Mac.
In the few cases that have been observed, Adware.Mac.WeDownload.1 has been recorded attempting to install Mac applications that have been infected with Trojan-type viruses, such as Program.Unwanted.MacKeeper, Mac.Trojan.Crossrider, Mac.Trojan.Genieo, Mac.BackDoor.OpinionSpy, and various Trojans belonging to the Trojan.Conduit family
Adware.Mac.WeDownload.1 tries to trick users into installing PUPs
