New Ransomware strain discovered targeting macOS users

guest · Jul 2, 2020

New ThiefQuest ransomware discovered targeting macOS users
ThiefQuest ransomware encrypts macOS systems but also installs a keylogger and a reverse shell for full control over infected hosts
June 30, 2020
https://www.zdnet.com/article/new-evilquest-ransomware-discovered-targeting-macos-users/

Security researchers have discovered this week a new ransomware strain targeting macOS users.

Named OSX.ThiefQuest (or EvilQuest), this ransomware is different from previous macOS ransomware threats because besides encrypting the victim's files, ThiefQuest also installs a keylogger, a reverse shell, and steals cryptocurrency wallet-related files from infected hosts.

"Armed with these capabilities, the attacker can main full control over an infected host," said Patrick Wardle, Principal Security Researcher at Jamf. This means that even if victims paid, the attacker would still have access to their computer and continue to steal files and keyboard strokes.
Wardle is currently one of the many macOS security researchers who are analyzing this new threat.
Click to expand...

Others who are also investigating EvilQuest include Thomas Reed, Director of Mac & Mobile at Malwarebytes, and Phil Stokes, macOS security researcher at SentinelOne.
Reed and Stokes are currently looking for a weakness or bug in the ransomware's encryption scheme [...]
THIEFQUEST IS DISTRIBUTED VIA PIRATED SOFTWARE
Devadoss tweeted about his finding yesterday, June 29. However, new evidence surfaced in the meantime has revealed that EvilQuest has been, in reality, distributed in the wild since the start of June 2020.

Reed told ZDNet in a phone call today that Malwarebytes found ThiefQuest hidden inside pirated macOS software uploaded on torrent portals and online forums, such as a pirated version of music production app Ableton, DJ mixing software Mixed In Key, and security tool Little Snitch.
Click to expand...

Objective-See: OSX.EvilQuest Uncovered

analyzing a new piece of mac ransomware (and more!)
It’s not everyday that a new piece of ransomware is uncovered that targets macOS. Moreover, as RansomWhere? claims to be able to generically detect such threats, I decided to take a peek at the malware and confirm my tool could detect it (with no a priori knowledge).
Click to expand...

Minimalist · Jul 1, 2020

EvilQuest: Inside A ‘New Class’ of Mac Malware

Mac expert Thomas Reed discusses how EvilQuest is ushering in a new class of Mac malware.
Click to expand...

https://threatpost.com/evilquest-inside-mac-malware/

guest · Jul 2, 2020

mood said: ↑

New ThiefQuest ransomware discovered targeting macOS users June 30, 2020
Click to expand...

Updated article (namechange of the malware)
...Reason:
Malwarebytes: New Mac ransomware spreading through piracy

Editor’s note: The original name for the malware, EvilQuest, has been changed due to a legitimate game of the same name from 2012. The new name is OSX.ThiefQuest.
Click to expand...

Rasheed187 · Jul 4, 2020

mood said: ↑

New ThiefQuest ransomware discovered targeting macOS users
ThiefQuest ransomware encrypts macOS systems but also installs a keylogger and a reverse shell for full control over infected hosts
June 30, 2020
https://www.zdnet.com/article/new-evilquest-ransomware-discovered-targeting-macos-users/

Objective-See: OSX.EvilQuest Uncovered
Click to expand...

Very cool that the RansomWhere? tool could block it! This shows how important pro-active tools are.

guest · Jul 7, 2020

Free decryptor available for ThiefQuest ransomware victims
July 7, 2020
https://www.zdnet.com/article/free-decryptor-available-for-thiefquest-ransomware-victims/

Cyber-security firm SentinelOne has released today a free decryptor app that can help victims of the TiefQuest ransomware recover their locked files.
The ThiefQuest ransomware -- initially identified under the name of EvilQuest -- targets only Mac users.

ThiefQuest's classification as a ransomware strain is tenuous. The malware is a smorgasbord of malicious code that includes modules for logging keystrokes, installing a reverse shell for backdoor access to infected hosts, code for stealing cryptocurrency-related data, and encrypting files (the so-called ransomware part).
THIEFQUEST CONTAINS A FAULTY RANSOMWARE COMPONENT
Based on previous analysis [1, 2, 3], the malware is considered to be in its early stages of development, and, as a result, some of its components don't seem to function correctly.

Unfortunately for victims, the ransomware part is one of those faulty components and appears to contain many unpolished features.
Click to expand...

SENTINELONE RELEASES FREE DECRYPTOR
However, security researchers from SentinelOne announced that after analyzing the ransomware source code and the differences between encrypted files and their original versions, they were able to reverse engineer ThiefQuest's encryption mechanism.
SentinelOne's ThiefQuest decryptor is provided in a binary form for now but the company said it plans to open-source the code at a later date.
Click to expand...

SentinelOne: Breaking EvilQuest | Reversing A Custom macOS Ransomware File Encryption Routine

A new macOS ransomware threat uses a custom file encryption routine

The routine appears to be partly based on RC2 rather than public key encryption

SentinelLabs has released a public decryptor for use with “EvilQuest” encrypted files

Click to expand...

guest · Jul 8, 2020

Hidden purpose of Mac ‘ransomware’ EvilQuest is data exfiltration, say researchers
July 8, 2020
https://www.scmagazine.com/home/sec...ilquest-is-data-exfiltration-say-researchers/

Researchers have developed a decryption tool for the recently discovered EvilQuest ransomware program designed to target Mac machines.
But several analysts now concur that EvilQuest’s malicious encryption may be more of a decoy, while the program’s true purpose appears to be data exfiltration.

In a new blog post this week, Thomas Reed, director of Mac and mobile at Malwarebytes, backed up an earlier conclusion by BleepingComputer that EvilQuest should be classified more as an information stealer and wiper that attempts to hide its data thievery through misdirection.
Additionally, Mac security company Objective-See has similarly reported that the malware is more than meets the eye, and “far more powerful and insidious” than any “mundane ransomware.”

“We definitely think the goal is more to hide evidence rather than being a real ransom,” said Reed in an interview with SC Media. “If the attacker were doing this for purely destructive purposes, they would not likely go to the effort of writing all the other code, and could have done a better job of destroying data.”
Click to expand...

Because of its info-stealing capabilities, and to avoid confusion with an unrelated video game called EvilQuest, BleepingComputer and Malwarebytes have instead begun referring to the malware as ThiefQuest.

In its own company blog post, SentinelOne reported that EvilQuest’s developers opted for symmetric key encryption, and according to research lead Jason Reaves, “…the clear text key used for encoding the file encryption key ends up being appended to the encoded file encryption key. Taking a look at a completely encrypted file shows that a block of data has been appended to it.”
It was this discovery that enabled SentinelOne to devise a decryptor.
Click to expand...

Malwarebytes: Mac ThiefQuest malware may not be ransomware after all

The ThiefQuest malware, which was discovered last week, may not actually be ransomware according to new findings. The behaviors that have been documented thus far are still all accurate, but we no longer believe that the ransom is the actual goal of this malware.
Why? That’s a great question, and there have been a number of bread crumbs that have led us to this conclusion.
Click to expand...

SentinelOne: “EvilQuest” Rolls Ransomware, Spyware & Data Theft Into One

As it turns out, this threat is much more than just a novel piece of ransomware, is under active development, and is one of the more complex threats to be seen so far targeting the Mac platform. In this post, we’ll cover what is known to date and bring you up-to-speed on the latest iterations.
Click to expand...

guest · Jul 20, 2020

Apple adds EvilQuest detection to Xprotect
Apple quickly updated its built-in anti-malware protection tool to combat latest threat
July 20, 2020
https://www.macworld.co.uk/news/mac-software/apple-adds-evilquest-detection-xprotect-3792962/

Apple has updated to its Xprotect anti-virus tool that is part of macOS with a new barrier against EvilQuest (also known as ThiefQuest).
We discuss the ThiefQuest/EvilQuest ransomware/malware in more detail here.

Xprotect and MRT (Malware Removal Tool) are two security precautions that feature in macOS that work in the background to keep your Mac secure and virus free.
On 13 July Apple shipped a new version of XProtect, now version 2126. This version came just a week after version in 2125, which is unusual for Xprotect. Normally updates are released every other week, or least that has been the case through the past six months.
Click to expand...

Apple doesn’t make it easy to see what has changed but Electric Light notes a new entry named MACOS.2070d41 among XProtect’s Yara definitions as well as some modifications to MACOS.6cb9746, which apparently detects ThiefQuest/EvilQuest and prevents installation.
How to check if Xprotect is up to date [...]
Click to expand...

Log in or Sign up

New Ransomware strain discovered targeting macOS users

guest Guest

Minimalist Registered Member

guest Guest

Rasheed187 Registered Member

guest Guest

guest Guest

guest Guest

Log in or Sign up

New Ransomware strain discovered targeting macOS users

guest Guest

Minimalist Registered Member

guest Guest

Rasheed187 Registered Member

guest Guest

guest Guest

guest Guest

Useful Searches