So far, researchers didn’t observe any final payload, which means this malware was created by cybercriminals for testing purposes. For example, this malware instructs launchd to execute a shell script every hour to download a JSON file to disk, convert its format to plist file, and use it to execute further malicious tasks. In addition, its process PlistBuddy creates LaunchAgent that instructs launchd, the Mac initialization system, to regularly run specific tasks. The malware dynamically generates malicious script in order to evade detection by security software. This is unusual because the latter Apple architecture is very new and there haven’t been many instances of malware designed for it so far. Silver Sparrow malware has two versions – version 1 contains a binary compiled for Intel x86_64 architecture, whole the version 2 includes binary designed for Intel x86_64 and M1 ARM64 architectures. However, if you’re a Mac user, we still recommend checking if your computer wasn’t infected earlier. Silver Sparrow malware acts as a malware dropper on the system.įollowing the discovery of this malware, Apple has taken actions to prevent further spread of it and revoked certificates for developer accounts used to sign the distributed packages.

Unfortunately, at this point the malware already resides in your system, despite your decision to click ‘ Cancel‘ or ‘ Continue.’ The user can see an ‘Install’ window that says ‘ This package will run a program to determine if the software can be installed‘. Silver Sparrow malware usually spreads via fake software update advertisements online and arrives in a fake Apple installer package named update.pkg or updater.pkg that both include malicious JavaScript which launches before the actual package installation procedure. In this article, we will explain how to remove this threat and secure your Mac for further usage. According to reports, this new malware strain has already compromised 29,139 macOS computers in 164 countries, the majority of instances being the United States, the United Kingdom, Canada, Germany and France. Additionally, this virus uses Launch Agent technique to persist on the compyter and be hard to remove.

The main purpose of this virus is to work as a backdoor to deliver malicious payloads to compromised system. Silver Sparrow malware is a newly detected Mac virus targeting different OS X architectures, including Apple’s new M1 ARM64 architecture. How to Detect and Remove Silver Sparrow malware from Mac.

Mac malware distribution vectors: how to avoid getting infected.Silver Sparrow malware infects nearly 30,000 Macs across 164 countries.

How to detect silver sparrow