1. Alien Photographer Mac Os Catalina
  2. Alien Photographer Mac Os X
  3. Alien Photographer Mac Os 11

Bands, Businesses, Restaurants, Brands and Celebrities can create Pages in order to connect with their fans and customers on Facebook. How do I scan a photo or document and attach the scanned image to an email? How do I convert my scanned documents into editable text? How do I change or select the program that starts when I press one of product buttons? How do I uninstall and reinstall the product software? How do I decide which scanning resolution to select when scanning?

AirBrush 7.0
AKVIS AirBrush is photo to painting software that makes an airbrush drawing from a photo.
  • License: Demo, $69 for Plug-in and Application, or $49 individually
  • Developer/Publisher: AKVIS
  • Modification Date: October 12, 2019
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 140.8 MB - Plug-in

Download File Size: 141 MB - Standalone Application

Blow Up 3.3.1
Blow Up keeps photos crystal clear during enlargement. Especially inlarge prints hung on a wall, the difference between Blow Up andPhotoshop is astounding. Version 3 makes pictures even sharper withoutcomputer artifacts.
If you understand Photoshop’s resize command then you already know howto use Blow Up. Our large library of standard paper sizes makes it eveneasier. With Lightroom and CMYK support, Blow Up fits into aprofessional workflow
  • License: Demo, $99
  • Developer/Publisher: Alien Skin Software
  • Modification Date: September 28, 2019
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 534.9 MB - Includes Exposure X3 (photo editor application and plug-in), Blow Up (plug-in), and Snap Art (plug-in)

Charcoal 4.0
AKVIS Charcoal is an artistic tool for conversion of photos into charcoal and chalk drawings.
Charcoal is one of the most popular materials for drawing. It lets youcreate a preliminary sketch as well as a finished work of art. Itcombines the advantages of different materials and can be used togetherwith different drawing tools. Using the sharpened charcoal you can makethin clear lines, but if you put it on the edge you'll get a wide loosestroke. Charcoal creates rich and easy picturesque strokes, bothdelicate and bold.
  • License: Demo, $69 for Plug-in and Application, or $49 individually
  • Developer/Publisher: AKVIS
  • Modification Date: October 12, 2019
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 152.1 MB - Plug-in

Download File Size: 152.3 MB - Standalone Application

Coloriage 12.0
The cutting edge technology of automatic photo colorizing that willchange your ideas about image colorization forever.
Coloriage manipulates the colors of an image: from colorizing old blackand white photos from your family album to replacing colors in yourcolor photos.Mac
Make a present for your grandmother by adding color to her school photo,replace the colors of your car to see how it would look in scarlet, seehow you will look if you dye your hair red.
  • License: Demo, $90 for Plug-in and Application, or $75 individually
  • Developer/Publisher: AKVIS
  • Modification Date: June 13, 2019
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 87.6 MB - Plug-in

Download File Size: 87.6 MB - Standalone Application

Draw 8.0
AKVIS Draw converts your photos into hand made pencil drawings. Thesoftware creates realistic looking line art illustrations and producesboth black and white and color drawings. Add a hand-drawn look to yourpictures.
  • License: Demo, $69 for Plug-in and Application, or $49 individually
  • Developer/Publisher: AKVIS
  • Modification Date: October 12, 2019
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 157.5 MB - Plug-in

Download File Size: 157.8 MB - Standalone Application

Exposure X4 5.0.2
The legendary effects plug-in is now an award-winning photo editor and organizer.
The most advanced version of our award-winning RAW photo editor is nowavailable. Exposure enables you to quickly create beautiful images andorganize your photos. Its blazing fast workflow speeds up image cullingand organizing. Exposure’s powerful creative tools include hundreds ofadjustable presets, portrait retouching tools, and many advanced specialeffects. Its flexible approach supports Photoshop and Lightroomworkflows, too.
  • License: Demo, $149, Bundled with Snap Art and Blow Up $199
  • Developer/Publisher: Alien Skin Software
  • Modification Date: September 28, 2019
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 534.9 MB - Includes Exposure X3 (photo editor application and plug-in), Blow Up (plug-in), and Snap Art (plug-in)

Eye Candy 7.2.3
Eye Candy 7 renders realistic effects that are difficult or impossibleto achieve in Photoshop alone, such as Fire, Chrome, and the newLightning. Effects like Animal Fur, Smoke, and Reptile Skin are renderedin exquisite detail down to individual hairs, turbulent wisps, and shinyscales.
Eye Candy helps you quickly explore and design looks. In Eye Candy 7,effects are chosen through easy to recognize icons rather than textmenus. Presets are rapidly previewed by simply mousing over them. Thetheme is less clicking and more visual browsing.
  • License: Demo, $129
  • Developer/Publisher: Alien Skin Software
  • Modification Date: September 26, 2019
  • Requirements: Mac OS X 10.7 or higher - 64-bit

Download File Size: 46.6 MB

Filter Forge 8.006
Filter Forge gives you unlimited access to a huge library of filters:seamless textures, visual effects, distortions, patterns, backgrounds,frames, and much more. They can be used for any commercial andnon-commercial purposes without limitations.
  • License: Demo, Basic $29, Standard $49, Professional Plus $308
  • Developer/Publisher: Filter Forge, Inc.
  • Modification Date: October 16, 2019
  • Requirements: Mac OS X 10.8 or higher - 64-bit

Download File Size: 99.5 MB

Flexify 2.9.4
Bend spherical panoramas into vertiginous new shapes.
Make hyper-wide-angle views
Print panoramas and maps as foldable solids and 'globe gores'
Simulate impossible lenses
  • License: Shareware, $54
  • Developer/Publisher: Flaming Pear
  • Modification Date: October 16, 2019
  • Requirements: Mac OS X 10.8 or higher - 64-bit, Photoshop CS5 or later

Download File Size: 36.6 MB

Flood 2.0.8
Inundate the landscape and submerge your friends. Create realisticpseudo-3D watery reflections with control over waves, ripples, andperspective.
  • License: Shareware, $33
  • Developer/Publisher: Flaming Pear
  • Modification Date: October 16, 2019
  • Requirements: Mac OS X 10.8 or higher - 64-bit, Photoshop CS5 or later

Download File Size: 3.9 MB

Freebies 1.6.1
Anaglyph Flip, AntiGhost, Circle to Square, ChromaSolarize, ColorSwap,Demitone 25, Demitone 50, Ghost, Gray from Blue, Gray from Green, Grayfrom Red, HSL to RGB, Kyoto Color, Lab to RGB, Make Cube Tile, Make IsoCube Tile, Ornament, Pixel Trash, RGB to HSL, RGB to Lab, Rule 30,Solidify A, Solidify B, Solidify C, Sphere Warp A, Sphere Warp B, Squareto Circle, Tachyon, TransLine, TransTone, Veins, Vitriol, Zephyr, andZombie.
  • License: Freeware
  • Developer/Publisher: Flaming Pear
  • Modification Date: October 17, 2019
  • Requirements: Mac OS X 10.8 or higher - 64-bit, Photoshop CS5 or later

Download File Size: 19.8 MB

Glitterato 1.7
Stars and nebulas with lots of realism and little fuss.
  • License: Shareware, $29
  • Developer/Publisher: Flaming Pear
  • Modification Date: October 16, 2019
  • Requirements: Mac OS X 10.8 or higher - 64-bit, Photoshop CS5 or later

Download File Size: 6.5 MB

Hue and Cry 1.7
Create abstract regions of color: vivid or pallid, structured ordiffuse, endless weird imagery is yours to use.
  • License: Shareware, $29
  • Developer/Publisher: Flaming Pear
  • Modification Date: October 16, 2019
  • Requirements: Mac OS X 10.8 or higher - 64-bit, Photoshop CS5 or later

Download File Size: 8.3 MB

India Ink 1.9

Alien Photographer Mac Os Catalina

Convert color images to unusual black-and-white halftones. Or use itscolor modes to produce strange etched effects.
  • License: Shareware, $29
  • Developer/Publisher: Lloyd Burchill/Flaming Pear
  • Modification Date: October 16, 2019
  • Requirements: Mac OS X 10.8 or higher - 64-bit, Photoshop CS5 or later

Download File Size: 5.8 MB

LunarCell 1.9.9
Instant planets. Fractal, reality-based, or just strange worlds are yours in seconds.
  • License: Shareware, $29
  • Developer/Publisher: Lloyd Burchill/Flaming Pear
  • Modification Date: October 16, 2019
  • Requirements: Mac OS X 10.8 or higher - 64-bit, Photoshop CS5 or later

Download File Size: 4.6 MB

Melancholytron 1.7.1
Make pictures moody, nostalgic, and somehow sad.
  • License: Shareware, $29
  • Developer/Publisher: Lloyd Burchill/Flaming Pear
  • Modification Date: October 16, 2019
  • Requirements: Mac OS X 10.8 or higher - 64-bit, Photoshop CS5 or later

Download File Size: 3.3 MB

Mr. Contrast 1.71
Add dramatic contrast to photos and hyper-emphasize detail.
  • License: Shareware, $29
  • Developer/Publisher: Lloyd Burchill/Flaming Pear
  • Modification Date: October 16, 2019
  • Requirements: Mac OS X 10.8 or higher - 64-bit, Photoshop CS5 or later

Download File Size: 4.5 MB

Neat Image 8.4.5
Neat Image is a filter designed to reduce visible noise and grain inphotographic images produced by digital cameras and scanners. Neat Imageis indispensable in low-light (indoors, night, astro) and high-speed(sport, action) photography. It is a tool for both professionalphotographers and digital image processing enthusiasts.
  • License: Demo, $35, Pro $60
  • Developer/Publisher: ABSoft
  • Modification Date: October 8, 2019
  • Requirements: Mac OS X 10.7.5 or higher - 64-bit, CS3 or higher

Download File Size: 16.8 MB - Plug-in

Download File Size: 22.6 MB - Standalone Application

Neon 4.0
AKVIS Neon lets you create amazing glowing line effects. The software transforms a photo into a neon image.
  • License: Demo, $49 for Plug-in and Application, or $39 individually
  • Developer/Publisher: AKVIS
  • Modification Date: September 24, 2019
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 145.7 MB - Plug-in

Download File Size: 146 MB - Standalone Application

Nik Collection 2.0.4
Express your artistic sensitivity with creative, powerful andeasy-access Nik Collection 2018 by DxO plugins.
Nik Collection by DxO is a series of 7 renowned creative MacOS andWindows plugins for Adobe Photoshop, Adobe Photoshop Elements and AdobeLightroom, providing filters, rendering and photography retouching toolsto create stunning images.
It leverages the U-PointTMtechnology for localized adjustments, andadds a full set of editing functionalities for amazing pictures: yourpictures.
  • License: Demo, $149
  • Developer/Publisher: DxO
  • Modification Date: June 4, 2019
  • Requirements: macOS 10.12 or higher - 64-bit, Photoshop CS5 or later

Download File Size: 777.8 MB - version 2.0.4

Download File Size: 618.2 MB - version 1.2.11

Noise Buster 10.4
Noise Buster is noise reduction software. It efficiently reduces noiseand grain in your images.
Digital noise can be produced by a number of factors: heating of thecamera sensor, long exposure shooting, small pixel size (thereforedigital compact cameras generate much noisier images than digital SLRs),high ISO settings, etc.
AKVIS Noise Buster is efficient noise suppression software. It reducesboth luminance and color noise on digital images without spoiling otheraspects of the photo.
  • License: Demo, $55 for Plug-in and Application, or $49 individually
  • Developer/Publisher: AKVIS
  • Modification Date: March 22, 2019
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 97 MB - Plug-in

Download File Size: 97.5 MB - Standalone Application

Noiseware 5.0.3
Noiseware is a high-performance noise suppression software tool designedto decrease or eliminate noise from digital photo or scanned images.
Unlike most image processing software techniques that utilize simplemethods (such as median filters) to treat digital noise in images,Noiseware features a sophisticated yet fast noise filtering algorithm.
Using the adaptive noise profile capability and sharpening function,Noiseware greatly reduces the visible noise while preserving the detailsin the images.
  • License: Demo, $80
  • Developer/Publisher: Imagenomic
  • Modification Date: August 29, 2018
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 3.2 MB

OilPaint 9.0
AKVIS OilPaint is photo to painting software that creates oil paintingsfrom photographs. The characteristic feature of the program is a uniquealgorithm of the artistic application of brush strokes thatauthentically reproduces the technique of the real brush.
  • License: Demo, $69 for Plug-in and Application, or $49 individually
  • Developer/Publisher: AKVIS
  • Modification Date: October 12, 2019
  • Requirements: Mac OS X 10.11 or higher - 64-bit

Download File Size: 166 MB - Plug-in

Download File Size: 166.2 MB - Standalone Application

Pastel 5.0
AKVIS Pastel is the best software for conversion of photos into pastelpaintings. The program turns your image into a lifelike digital artimitating one of the most popular artistic techniques - pastel art.
Pastel bridges the gap between painting and drawing. The pastel sticksconsisting of powdered pigment generate soft velvety strokes with subtleedges which can be smeared with your fingers. To paint in pastels, youneed a rough textured surface which holds the pigment.
  • License: Demo, $69 for Plug-in and Application, or $49 individually
  • Developer/Publisher: AKVIS
  • Modification Date: October 12, 2019
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 156 MB - Plug-in

Download File Size: 156.2 MB - Standalone Application

PhotoWiz
The PhotoWiz Collection offers tools for correcting, enhancing andrestoring digital images. With it even beginners are capable ofachieving expert results. It is available for Windows as well as MacOS.
It contains seven plugins for Photoshop, Photoshop Elements, PaintShopPro, Affinity Photo and many other applications.
  • License: Shareware, $100
  • Developer/Publisher: Harald Heim
  • Modification Date: November 14, 2018
  • Requirements: Mac OS X 10.6 or higher - 64-bit

Download File Size: 9.3 MB

Plugin Galaxy 2.08
Plugin Galaxy is a plugin for creating special effects and enhancingimages with the help of more than 160 basic effects.
  • License: Shareware, $50
  • Developer/Publisher: Harald Heim
  • Modification Date: November 15, 2018
  • Requirements: Mac OS X 10.6 or higher - 64-bit

Download File Size: 2.7 MB

Points 5.0
AKVIS Points lets you transform your photos into paintings using one ofthe most exciting artistic techniques - pointillism. With the softwareyou can easily create gorgeous works of art in a pointillist manner.
  • License: Demo, $49 for Plug-in and Application, or $39 individually
  • Developer/Publisher: AKVIS
  • Modification Date: October 12, 2019
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 174.2 MB - Plug-in

Download File Size: 174 MB - Standalone Application

Portraiture 3.5.2
Portraiture for Photoshop eliminates the tedious manual labor ofselective masking and pixel-by-pixel treatments to help you achieveexcellence in portrait retouching.
Inimitable skin smoothing, healing and enhancing effects plugin
  • License: Demo, $200
  • Developer/Publisher: Imagenomic
  • Modification Date: June 27, 2019
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 6.1 MB

Alien Photographer Mac Os X

Realgrain 2.0.1
If you are looking for a superior black-and-white conversion, toning andcolor effects or long for the darkroom age to achieve the soft, warmgraininess of film, then Realgrain is the plugin for you.
  • License: Demo, $100
  • Developer/Publisher: Imagenomic
  • Modification Date: August 29, 2018
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 5 MB

Retoucher 9.6
Retoucher does not only remove dust, scratches, stains and other defectsthat appear on damaged photos but is also able to reconstruct thelacking parts of the photo using the information of the surroundingareas.
The work is done automatically; you only have to indicate areas to berestored, push the button, and here you are - the surface becomes smoothand imperfections disappear. It looks like magic when you observe thescratches vanishing before your very eyes.
  • License: Demo, $98 for Plug-in and Application, or $87 individually
  • Developer/Publisher: AKVIS
  • Modification Date: March 27, 2019
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 91.8 MB - Plug-in

Download File Size: 91.7 MB - Standalone Application

Sketch 22.0
AKVIS Sketch converts photos into pencil sketches and even createswatercolor paintings.
Now you do not need to handle a pencil to feel like an artist. All youneed to create your original work of art is good taste and AKVIS Sketch!
We propose an efficient method that lets you create realistic colordrawings and B&W sketches, imitate the technique of graphite and colorpencil, and even generate the charcoal, pastel, and watercolor effects.
In contrast to standard filters that offer an approximate sketch, AKVISSketch comes very close to the hand-drawn works of a human artist.Getting a similar result with the standard tools would require expertisein image editing and extensive manipulation with layers, masks, brushesand applying filters. AKVIS Sketch lets you create an awesome pencildrawing from any photograph with a mouse click!
  • License: Demo, $89 for Plug-in and Application, or $72 individually
  • Developer/Publisher: AKVIS
  • Modification Date: October 12, 2019
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 177 MB - Plug-in

Download File Size: 177.2 MB - Standalone Application

Snap Art 4.1.3
Transforming your photographs into beautiful works of art has never beeneasier than with Snap Art. By analyzing the visual elements andtechniques of artists through the centuries, we have designed Snap Artto produce images that look they were made by a human, not a computer.
Snap Art lets you experiment with multiple artistic styles via asimple, sleek user interface. The refreshed design and layout reducesdistractions and provides fast visual browsing of a wide array ofpresets so you can achieve perfect results quicker than ever. Snap Artworks everywhere you do, including as a standalone application thatprovides easy batch processing.
  • License: Demo, $99
  • Developer/Publisher: Alien Skin Software
  • Modification Date: September 28, 2019
  • Requirements: Mac OS X 10.10 or higher - 64-bit
Photographer

Download File Size: 534.9 MB - Includes Exposure X3 (photo editor application and plug-in), Blow Up (plug-in), and Snap Art (plug-in)

SolarCell 1.9.9
Create suns in a fantasy style. Design your own sun with controls for every part of itsappearance, or roll the dice and see what happens.
  • License: Shareware, $29
  • Developer/Publisher: Lloyd Burchill/Flaming Pear
  • Modification Date: October 16, 2019
  • Requirements: Mac OS X 10.8 or higher - 64-bit, Photoshop CS5 or later

Download File Size: 5 MB

SuperBladePro 1.9.4
The plugin filter that combines textures with bevels and mirrorlikereflections.
Quickly create tarnish, iridescence, and glassiness for appealingly'touchable' 3-D looks.
SuperBladePro's features include waterstains, moss, abrasion,spotlighting, dust, grit, embossing, fractal blotches, and smoothGaussian bevels.
  • License: Shareware, $44
  • Developer/Publisher: Lloyd Burchill/Flaming Pear
  • Modification Date: October 15, 2019
  • Requirements: Mac OS X 10.8 or higher - 64-bit, Photoshop CS5 or later

Download File Size: 19.5 MB

SuperPNG 2.5
SuperPNG is a free Adobe Photoshop plug-in for using PNG ('ping') files.It is faster than Adobe's own PNG plug-in and saves considerably smallerPNGs.

Alien Photographer Mac Os 11


PNG is an open source file format that supports tight losslesscompression. It can be read on any platform by most graphicsapplications and is fully supported by all modern web browsers.
SuperPNG has been tested to work on Photoshop CS3 and later, but it willprobably work in earlier versions—possibly much earlier versions. Try itand find out!
  • License: Freeware
  • Developer/Publisher: fnord
  • Modification Date: March 23, 2015
  • Requirements: Mac OS X 10.4.8 or higher - 64-bit, CS3 or higher

Download File Size: 2.7 MB

SymmetryShop 4.20
SymmetryShop is all you need to create professional pattern designs inAdobe Photoshop. Now in its fourth release, this plug-in makes thedesign process quick, easy, and fully automatic. Select a part of animage and the plug-in does the rest. SymmetryShop patterns stay editableforever: refine your source image and rebuild the pattern at any time.
  • License: Demo, $315
  • Developer/Publisher: Artlandia, Inc.
  • Modification Date: June 6, 2015
  • Requirements: Mac OS X 10.9 or higher - 64-bit, CC 2014 or higher

Download File Size: 42,3 MB

Texture Anarchy 1.2.5
Texture Anarchy is a set of Adobe Photoshop filters for creatingtextures and borders. With these three Photoshop texture filters, youcan create a variety of seamless, infinite textures that range fromrealistic and organic to design-appropriate. Plain old math is used togenerate, extend, and output an image.
  • License: Demo, $129
  • Developer/Publisher: Digital Anarchy
  • Modification Date: August 11, 2016
  • Requirements: Mac OS X 10.5 or higher - 64-bit, Photoshop 7.0 to Creative Cloud

Download File Size: 31.9 MB

ToonIt 3.0.2
ToonIt! is a cartoon effects plug=in that gives you the ability toturn still images and photographs into unique cartoon creations. ToonIt!gives you precise control over styles, shading and outlines. ToonIt!Photo will get your creative juices flowing 'cause everyone looks betteras a cartoon
  • License: Demo, $129
  • Developer/Publisher: Digital Anarchy
  • Modification Date: July 15, 2016
  • Requirements: Mac OS X 10.6 or higher - 64-bit, Photoshop CS to Creative Cloud

Download File Size: 6.8 MB

Watercolor 5.0
AKVIS Watercolor turns your photos into watercolor paintings. Theproduct is available as a standalone program and as a Photoshopcompatible plugin.
Watercolor painting is one of the oldest and most commonly used paintingtechniques in which color pigments are solvable in water. Aquarellepaintings have a brilliant and luminous look based on the clarity andtranslucency of colors and the flowing fluidity of lines.
  • License: Demo, $69 for Plug-in and Application, or $49 individually
  • Developer/Publisher: AKVIS
  • Modification Date: October 12, 2019
  • Requirements: Mac OS X 10.10 or higher - 64-bit

Download File Size: 172.4 MB - Plug-in

Download File Size: 172.2 MB - Standalone Application

MacSpy is advertised as the 'most sophisticated Mac spyware ever”, with the low starting price of free. While the idea of malware-as-a-service (MaaS) isn’t a new one with players such as Tox and Shark the game, it can be said that MacSpy is one of the first seen for the OS X platform.

The authors state that they created this malware due to Apple products gaining popularity in the recent years. They also state that during their tenure in the field that they have noticed a lack of 'sophisticated malware for Mac users' and they believe that 'people were in need of such programs on MacOS'. So they created MacSpy. The MacSpy authors claim to have the following features in the free version of their RAT:

If you are willing to pay an unknown amount of bitcoins for the advanced version, the malware authors advertise the following features:

MacSpy is not as polished as some of the malware-as-a-service providers out there, as there doesn’t seem to be any customer facing automated service of signing up for their service. In order to receive a copy of MacSpy we had to email the author our preferred username and password, in order for them to make us an account. After confirming our details they created an account for us, and delivered a zipped file and the following instructions:

Initial Analysis

After unzipping the archive we observed it contained the following files:

The archive contains four files:

  • Mach-O 64-bit executable called 'updated'
  • Mach-O 64-bit executable called 'webkitproxy'
  • Mach-O 64-bit dynamically linked shared library called 'libevent-2.0.5.dylib'
  • Config file

After examining webkitproxy and libevent-2.0.5.dylib, we noted they are signed by Tor, and thus we concluded that they are related to the function of Tor Onion routing. The contents of the config file further convince us of our suspicions are correct:

Config Contents

The 'updated' file, on the other hand is not digitally signed, and it is currently completely undetected by various AV companies on VirusTotal.

Anti-Analysis

MacSpy has several countermeasures that hamper analysis efforts. To prevent debugging, it calls ptrace() with the PT_DENY_ATTACH option. This is a common anti-debugger check and will prevent debuggers from attaching to the process.

If you bypass the ptrace countermeasure, MacSpy has additional code that checks if it is running in a debugger.

The code above is very similar to the debugger checking code from this Stack Overflow post.

In addition to the anti-debugging countermeasures, MacSpy contains checks against the execution environment that can make it difficult to run in a virtual machine. In the code below, you can see that MacSpy checks that the number of physical CPUs is greater than 1, the number of logical cores is greater than 3, and the number of logical cores is twice the number of physical cores. MacSpy also checks that there is at least 4 GB of memory on the host. Since malware sandboxes often run with minimal resources, these checks can prevent proper execution in virtual environments.

Similar to MacRansom, MacSpy also compares the machine model to 'Mac' using the 'sysctl' command. MacSpy will kill all Terminal windows which can be annoying to analysts using command line tools to analyze the malware (OSX/Dok exhibits similar behavior by killing Terminal windows).

Persistence

In order to persist on the system the malware creates a launch entry in ~/Library/LaunchAgents/com.apple.webkit.plist. This ensures that the malware will run at start up to continue collecting information.

Behavior Analysis:

Upon execution, successfully passing the anti-analysis checks and setting persistence, the malware then copies itself and associated files from the original point of execution to '~/Library/.DS_Stores/' and deletes the original files in an attempt to stay hidden from the user. The malware then checks the functionality of its tor proxy by utilizing the curl command to contact the command and control server. After connecting to the CnC, the malware sends the data it had collected earlier, such as system information, by sending POST requests through the TOR proxy. This process repeats again for the various data the malware has collected. After exfiltration of the data, the malware deletes the temporary files containing the data it sent.

The following curl command used to exfiltrate data:

Contents of ~/Library/.DS_Stores/data/tmp/SystemInfo

User Web Portal

In our initial email to the malware authors we sent a set of credentials that we wanted to use in their web portal. After logging into the MacSpy web portal you are greeted with a very bare bones directory listing containing a folder labeled the most recent date of the malware executing on a system in the YYYYMM format, followed by a folder in the DD format. Diving into that folder you're treated with a series of directories similar to that of the directory naming on the victim system. Inside these folders is the data that was collected from the victim the malware was executed on.

Detection

NIDS

The best way to detect MacSpy running on a Mac is to use a combination of Network IDS (NIDS) rules as it communicates. As it turns out, AlienVault provides this rule in its threat intelligence, which has already been updated with a rule called 'System Compromise, Malware RAT, MacSpy'. This feeds into the USM correlation engine to generate an alarm that will notify AlienVault customers that one of their systems is compromised.

Osquery

Yara

You can use the rule below in any system that supports Yara to detect this Mac-based malware.

Conclusion

People generally assume when they are using Macs they are relatively safe from malware. This has been a generally true statement, but this belief is becoming less and less true by the day, as evidenced by the increasing diversity in mac malware along with this name family. While this piece of Mac malware may not be the most stealthy program, it is feature rich and it goes to show that as OS X continues to grow in market share and we can expect malware authors to invest greater amounts of time in producing malware for this platform.

If you want to find out more about this malware, here is a pulse we have in the AlienVault Open Threat Exchange (OTX):

Appendix:

6c03e4a9bcb9afaedb7451a33c214ae4
c72de549a1e72cfff928e8d2591d7e97
cc07ab42070922b760b6bf9f894d0290
27056cabd185e939195d1aaa2aa1030f
f38977a34b1f6d8592fa17fafdb76c59