Digita Security

Cybersecurity solutions for the

  • modern
  • mobile
  • independent
  • innovative
  • enterprising

macOS workforce

2.14.2015 ( Version 2058 )

InstallImitatorA

Also Known As: OSX/FlashImitator, OSX/InstallCore

OSX/InstallImitator is a Potentially Unwanted Program (PUP) download manager, "installCore installer for Macs" by ironSource. The installer is used to deliver Adware and other Potentially Unwanted Programs (PUPs) to the infected computer, often imitating installers for widely used applications [1].

References:
  1. https://www.sentinelone.com/2015/02/02/osx-ironcore-a-or-what-we-know-about-osx-flashimitator-a/

Sample Hashes (VT links):
f58722369a28920076220247a0c4e3360765f0ba
3b7e269867c5e1223f502d39dc14de30b1efdda9
734d7e37ec664a7607e62326549cb7d3088ed023
ea45a2a22ca9a02c07bb4b2367e5d64ea7314731
f9646dc74337ee23a8c159f196419c46518a8095
cd9b8da9e01f3ebf0e13c526a372fa65495e3778
4c87de3aa5a9c79c7f477baa4a23fba0e62dc9d8
16b59ab450a9c1adab266aefcf4e8f8cf405ac9c
4df5387fe72b8abe0e341012334b8993f399d366