Mono Framework For Mac

Mono for macOS is available as a Mac Package (.pkg)

Sudo apt-get remove mono-complete # Edit your mono-xamarin.list and pin it to the version of your choice. Sudo apt-get update sudo apt-get install mono-complete Accessing older releases If for some reason you want to pin an older version of Mono rather than updating to the latest, you can modify the Debian repository to 'wheezy/snapshots/X.XX. 301 Moved Permanently.

Please refer to the installation guide for more information about how to install and configure your Mono environment.

Supported on macOS 10.9 and later. Check the uninstall instructions if you want to remove Mono from your Mac.

Ubuntu

Debian

Raspbian

CentOS/RHEL

Fedora

• I'm trying to get a Mono install running on a mac (OS X version 10.10.5), and while the install states that it's completed successfully, I'm not able to call mono from the terminal.
• Microsoft.NET Framework Version 4.7.03056. Installed Version: Enterprise. Visual Basic 2017 Microsoft Visual Basic 2017. Visual C# 2017 Microsoft Visual C# 2017. Mono Debugging for Visual Studio 4.8.4-pre (3fe64e3) Support for debugging Mono processes with Visual Studio. NuGet Package Manager 4.5.0 NuGet Package Manager in Visual Studio.
• Running Mono applications on macOS. Running applications on macOS is very similar to linux systems, from the terminal: mono myprogram.exe For GTK# applications, it's easiest to run them the same way but using xterm from X11.app. A macOS specific Mono launcher.

1 Add the Mono repository to your system

The package repository hosts the packages you need, add it with the following commands.

Note: the packages should work on newer Ubuntu versions too but we only test the ones listed below.

Ubuntu 20.04 (amd64, armhf, arm64, ppc64el)

Ubuntu 18.04 (i386, amd64, armhf, arm64, ppc64el)

Ubuntu 16.04 (i386, amd64, armhf, arm64, ppc64el)

2 Install Mono

The package mono-devel should be installed to compile code.

The package mono-llvm-support should be installed for LLVM JIT/AOT support. See here for more about LLVM Mono.

The package mono-complete should be installed to install everything - this should cover most cases of 'assembly not found' errors.

The package mono-dbg should be installed to get debugging symbols for framework libraries - allowing you to get line numbers in stack traces.

The package referenceassemblies-pcl should be installed for PCL compilation support - this will resolve most cases of 'Framework not installed: .NETPortable' errors during software compilation.

The package ca-certificates-mono should be installed to get SSL certificates for HTTPS connections. Install this package if you run into trouble making HTTPS connections.

The package mono-xsp4 should be installed for running ASP.NET applications.

3 Verify Installation

After the installation completed successfully, it's a good idea to run through the basic hello world examples on this page to verify Mono is working correctly.

Notes

Mono on Linux before 3.12 by default didn't trust any SSL certificates so you got errors when accessing HTTPS resources. This is not required anymore as 3.12 and later include a new tool that runs on package installation and syncs Mono's certificate store with the system certificate store (on older versions you had to import Mozilla's list of trusted certificates by running mozroots --import --sync). Some systems are configured in a way so that the necessary package isn't pulled in when Mono is installed, in those cases make sure the ca-certificates-mono package is installed.

1 Add the Mono repository to your system

The package repository hosts the packages you need, add it with the following commands.

Note: the packages should work on newer Debian versions too but we only test the ones listed below.

Mono Framework For Mac Operating System

Debian 10 (i386, amd64, armhf, arm64, armel, ppc64el)

Debian 9 (i386, amd64, armhf, arm64, armel, ppc64el)

2 Install Mono

The package mono-devel should be installed to compile code.

The package mono-llvm-support should be installed for LLVM JIT/AOT support. See here for more about LLVM Mono.

The package mono-complete should be installed to install everything - this should cover most cases of 'assembly not found' errors.

The package mono-dbg should be installed to get debugging symbols for framework libraries - allowing you to get line numbers in stack traces.

The package referenceassemblies-pcl should be installed for PCL compilation support - this will resolve most cases of 'Framework not installed: .NETPortable' errors during software compilation.

The package ca-certificates-mono should be installed to get SSL certificates for HTTPS connections. Install this package if you run into trouble making HTTPS connections.

The package mono-xsp4 should be installed for running ASP.NET applications.

3 Verify Installation

After the installation completed successfully, it's a good idea to run through the basic hello world examples on this page to verify Mono is working correctly.

Notes

Mono on Linux before 3.12 by default didn't trust any SSL certificates so you got errors when accessing HTTPS resources. This is not required anymore as 3.12 and later include a new tool that runs on package installation and syncs Mono's certificate store with the system certificate store (on older versions you had to import Mozilla's list of trusted certificates by running mozroots --import --sync). Some systems are configured in a way so that the necessary package isn't pulled in when Mono is installed, in those cases make sure the ca-certificates-mono package is installed.

1 Add the Mono repository to your system

The package repository hosts the packages you need, add it with the following commands.

Note: the packages should work on newer Raspbian versions too but we only test the ones listed below.

Raspbian 10 (armhf)

Raspbian 9 (armhf)

2 Install Mono

The package mono-devel should be installed to compile code.

The package mono-llvm-support should be installed for LLVM JIT/AOT support. See here for more about LLVM Mono.

The package mono-complete should be installed to install everything - this should cover most cases of 'assembly not found' errors.

The package mono-dbg should be installed to get debugging symbols for framework libraries - allowing you to get line numbers in stack traces.

The package referenceassemblies-pcl should be installed for PCL compilation support - this will resolve most cases of 'Framework not installed: .NETPortable' errors during software compilation.

The package ca-certificates-mono should be installed to get SSL certificates for HTTPS connections. Install this package if you run into trouble making HTTPS connections.

The package mono-xsp4 should be installed for running ASP.NET applications.

3 Verify Installation

After the installation completed successfully, it's a good idea to run through the basic hello world examples on this page to verify Mono is working correctly.

Notes

Mono on Linux before 3.12 by default didn't trust any SSL certificates so you got errors when accessing HTTPS resources. This is not required anymore as 3.12 and later include a new tool that runs on package installation and syncs Mono's certificate store with the system certificate store (on older versions you had to import Mozilla's list of trusted certificates by running mozroots --import --sync). Some systems are configured in a way so that the necessary package isn't pulled in when Mono is installed, in those cases make sure the ca-certificates-mono package is installed.

1 Add the Mono repository to your system

The package repository hosts the packages you need, add it with the following commands in a root shell.

Note: the packages should work on newer CentOS/RHEL versions too but we only test the ones listed below.

CentOS/RHEL 8 (x86_64)

CentOS/RHEL 7 (x86_64)

CentOS/RHEL 6 (x86_64, i686)

2 Install Mono

The package mono-devel should be installed to compile code.

The package mono-complete should be installed to install everything - this should cover most cases of 'assembly not found' errors.

The package referenceassemblies-pcl should be installed for PCL compilation support - this will resolve most cases of 'Framework not installed: .NETPortable' errors during software compilation.

The package xsp should be installed for running ASP.NET applications.

3 Verify Installation

After the installation completed successfully, it's a good idea to run through the basic hello world examples on this page to verify Mono is working correctly.

1 Add the Mono repository to your system

The package repository hosts the packages you need, add it with the following commands in a root shell.

Note: we're using the CentOS/RHEL repositories on Fedora.

Fedora 29 (x86_64)

Fedora 28 (x86_64)

2 Install Mono

The package mono-devel should be installed to compile code.

The package mono-complete should be installed to install everything - this should cover most cases of 'assembly not found' errors.

The package referenceassemblies-pcl should be installed for PCL compilation support - this will resolve most cases of 'Framework not installed: .NETPortable' errors during software compilation.

The package xsp should be installed for running ASP.NET applications.

3 Verify Installation

After the installation completed successfully, it's a good idea to run through the basic hello world examples on this page to verify Mono is working correctly.

Mono for Windows is available as a Windows Installer file

Please refer to the installation guide for more information about how to install and configure your Mono environment.

Supported on Windows 7, 8, 10 or later.

Installer for running Gtk#-based applications on Microsoft .NET:

Malware

We found an EXE application that specifically runs on Mac to download an adware and info stealer, sidestepping built-in protection systems on the platform such as Gatekeeper.

Update as of 6:00 P.M. PST, May 3, 2019: Our continued observation of the malware sample showed that it spoofs popular Mac apps, instead of being included in the app installers themselves as previously reported. We made the corrections in the technical analysis in this post. We would also like to thank Objective Development for clarifying this issue.

Update as of 5:00 P.M. PST, February 18, 2019: Further analysis on the sample indicated that it does not bypass the Gatekeeper mechanism as previously reported. We made the necessary changes in the technical analysis in this post. We would also like to thank Apple Product Security team for reaching out to us to clarify this issue.

EXE is the official executable file format used for Windows to signify that they only run on Windows platforms, and to serve as a security feature. By default, attempting to run an EXE file on a Mac or Linux OS will only show an error notification.

However, we found EXE files in the wild delivering malicious payload on macOS recently. While no specific attack pattern is seen, our telemetry showed the highest numbers for infections to be in the United Kingdom, Australia, Armenia, Luxembourg, South Africa, and the United States.

Behavior

The samples pose as installers of popular apps and are often available for download from various torrent websites. Examples of the applications they pose as are as follows:

• Paragon_NTFS_for_Mac_OS_Sierra_Fully_Activated.zip
• Wondershare_Filmora_924_Patched_Mac_OSX_X.zip
• LennarDigital_Sylenth1_VSTi_AU_v3_203_MAC_OSX.zip
• Sylenth1_v331_Purple_Skin__Sound_Radix_32Lives_v109.zip
• TORRENTINSTANT.COM+-+Traktor_Pro_2_for_MAC_v321.zip
• Little_Snitch_583_MAC_OS_X.zip

When the downloaded .ZIP file is extracted, it contains a .DMG file hosting the supposed installer of the spoofed app.

Figure 1. Sample of the malicious file

Figure 2. Installer contained in the .DMG sample we analyzed posing as a legitimate application

Inspecting the installer contents, we found the unusual presence of the .EXE file bundled inside the app, verified to be a Windows executable responsible for the malicious payload.

Figure 3. Suspicious .EXE bundled for Mac app installer

When the installer is executed, the main file also launched the executable as it is enabled by the mono framework included in the bundle. This framework allows the execution of Microsoft .NET applications across platforms such as OSX.

Mono Framework For Mac

Once run, the malware collects the following system information:

• ModelName
• ModelIdentifier
• ProcessorSpeed
• ProcessorDetails
• NumberofProcessors
• NumberofCores
• Memory
• BootROMVersion
• SMCVersion
• SerialNumber
• UUID

Under the /Application directory, the malware also scans for all the basic and installed apps and sends all the information to the C&C server:

• App Store.app
• Automator.app
• Calculator.app
• Calendar.app
• Chess.app
• Contacts.app
• DVD Player.app
• Dashboard.app
• FaceTime.app
• Font Book.app
• Image Capture.app
• iTunes.app
• Launchpad.app
• Mail.app
• Maps.app
• Messages.app
• Mission Control.app
• Notes.app
• Photo Booth.app
• Photos.app
• Preview.app
• QuickTime Player.app
• Reminders.app
• Safari.app
• Siri.app
• Stickies.app
• System Preferences.app
• TextEdit.app
• Time Machine.app
• UtilitiesiBooks.app

It downloads the following files from the Internet and saves it to the directory ~/Library/X2441139MAC/Temp/:

• hxxp://install.osxappdownload.com/download/mcwnet
• hxxp://reiteration-a.akamaihd.net/INSREZBHAZUIKGLAASDZFAHUYDWNBYTRWMFSOGZQNJYCAP/FlashPlayer.dmg
• hxxp://cdn.macapproduct.com/installer/macsearch.dmg

Figure 4. Downloaded files saved in the directory

These .DMG files are mounted and executed as soon as they are ready, as well as displaying a PUA during execution.

Figure 5. One of the adwares downloaded posing as a popular app

This malware runs specifically to target Mac users. Attempting to run the sample in Windows displays an error notification.

Figure 6. Error notification when installer is executed in Windows

Currently, running EXE on other platforms would have no impact on non-Windows systems such as MacOS. A mono framework installed in the system is required to compile or load these executables and libraries. In this case, however, the bundling of the said framework with the malicious files becomes a workaround to enable EXE files to run on Mac systems. As for the native library differences between Windows and MacOS, the mono framework supports DLL mapping to support Windows-only dependencies to their MacOS counterparts. Overall, this technique may be done to overcome a malicious user's Objective-c coding limitations.

Conclusion

We suspect that this specific malware can be used for future inter-platform attacks, where a single executable can perform its payload on different operating systems. We believe that the cybercriminals are still studying the development and opportunities from this malware bundled in apps and available in torrent sites. We will continue investigating how cybercriminals can use this information and routine. Users should avoid or refrain from downloading files, programs, and software from unverified sources and websites, and install a multi-layered protection for their individual and enterprise systems.

Mono Framework For Mac Windows 10

Trend Micro Solutions

The following Trend Micro products detect and block this threat:

Trend Micro Antivirus for Mac
Trend Micro Smart Protection Suites

Indicators of Compromise