#PIRATE APP FOR MAC INSTALL#
Note: anyone infected with this ransomware or any ransomware should not pay the fee, because it does not remove the malware.Īlong with the ransom activity, the malware may also install a keylogger for monitoring keystrokes, but what the malware does with the functionality is unknown. Malwarebytes found the ransomware to work poorly and was not able to get instructions on paying the ransom, but a screenshot found on the forums where the malicious software originated suggests it's meant to prompt users to pay $50 to recover access to their files. The Finder also malfunctioned after installation, and there were problems with the dock and other apps. The ransomware encrypts settings and data files on the Mac, like Keychain files, resulting in an error when attempting to access the iCloud Keychain. From there, the Patch file installs itself in several spots on the Mac. The installation script moves the Patch file into a new location and renames it CrashReporter, a legitimate macOS process, keeping it hidden in Activity Monitor.
It installed the actual version of Little Snitch, but it also installed an executable file named "Patch" into the /Users/Shared directory and a post-install script for infecting a machine. Right from the point of download, it was clear that something was wrong with the illicit version of Little Snitch, as it had a generic installer package.
The new ransomware was found in pirated download for the Little Snitch app found on a Russian forum. There's a new 'EvilQuest' Mac ransomware variant that's spreading through pirated Mac apps, according to a new report shared today by Malwarebytes.
0 kommentar(er)
