Variant of Mac Malware Another Party Puper

We recently received a new sample of the Mac malware OSX/Puper.a. This file [MD5 Sum: 428143005E07E510302BA431FE0C28CC], which disguises itself as a Mac Cinema Installer, was recently mentioned in PC Magazine.

When the DMG file is executed on the Mac, it displays the following message:

As the execution continues, the malware gets installed on the machine with the root user’s credentials. Below is a screen shot of the malware after installation:

The file AdobeFlash in the screen above is the malicious script file. This file is obfuscated using Uuencode and looks like this before decoding:

And like this after decoding:

From the shot above we can see another set of obfuscated code after the schedule-task instructions. We can also see that the malware creates a scheduled job to run itself once every five hours, shown as below:

Decoding the rest of the script reveals the following:

From the screen above we see that the malware downloads the file generator.pl and executes it.

Although the number of malware for Macs still remains tiny when compared with the number of malware for Microsoft Windows, new variants of malware such as this remind us to be careful.