Mix in key torrent download key detection install#
Mix in key torrent download key detection Patch#
Mix in key torrent download key detection software#
Mix in key torrent download key detection code#
Mix in key torrent download key detection mac#

Mix in key torrent download key detection Patch#

It contained a copy of the patch file, with a second copy of the data from that file appended to the end, followed by an additional 9 bytes: the hexidecimal string 03705701 00CEFAAD DE. The latter was identical to the original patch file, but the former was modified in a very strange way. Strangely, the malware also copied itself to the following files: /Users/user/Library/.ak5t3o0X2 /private/var/root/Library/.5tAxR3H3Y Since it’s quite rare for anyone to actually log in as root, this doesn’t serve any practical purpose.

Mix in key torrent download key detection code#

The latter in each group of files, found in /private/var/root/, is likely to be due to a bug in the code that creates the files in the user folder, leading to creation of the files in the root user’s folder. It also set up persistence via launch agent and daemon plist files: /Library/LaunchDaemons/ /Users/user/Library/LaunchAgents/ /private/var/root/Library/LaunchAgents/

Both variants installed copies of the patch file at the following locations: /Library/AppQuest/ /Users/user/Library/AppQuest/ /private/var/root/Library/AppQuest/ Once the infection was triggered by the installer, the malware began spreading itself quite liberally around the hard drive. This one did not include code to launch a legitimate installer, and simply dropped the Mixed In Key app into the Applications folder directly. !/bin/sh mkdir /Library/mixednkey mv /Applications/Utils/patch /Library/mixednkey/toolroomd rmdir /Application/Utils chmod +x /Library/mixednkey/toolroomd /Library/mixednkey/toolroomd & The Mixed In Key installer turned out to be quite similar, though with slightly different file names and postinstall script. There are undoubtedly other installers floating around as well that have not been seen.

Mix in key torrent download key detection software#

While waiting for the malware to do something-anything!-further investigation turned up an additional malicious installer, for some DJ software called Mixed In Key 8, as well as hints that a malicious Ableton Live installer also exists (although such an installer has not yet been found). Further, the malware didn’t actually start encrypting anything, despite the fact that I let it run for a while with some decoy documents in position as willing victims. The malware got installed, but the attempt to run the Little Snitch installer got hung up indefinitely, until I eventually forced it to quit. Finally, it launches the Little Snitch installer. It then removes itself from the /Users/Shared/ folder and launches the new copy. As there is a legitimate process that is part of macOS named Crash Reporter, this name will blend in reasonably well if seen in Activity Monitor. The script moves the patch file into a location that appears to be related to LittleSnitch and renames it to CrashReporter. !/bin/sh mkdir /Library/LittleSnitchd mv /Users/Shared/Utils/patch /Library/LittleSnitchd/CrashReporter rmdir /Users/Shared/Utils chmod +x /Library/LittleSnitchd/CrashReporter /Library/LittleSnitchd/CrashReporter open /Users/Shared/LittleSnitchInstaller.app & It is normal for this type of installer to contain preinstall and/or postinstall scripts, for preparation and cleanup, but in this case the script was used to load the malware and then launch the legitimate Little Snitch installer. The installer also contained a postinstall script-a shell script that is executed after the installation process is completed.

Mix in key torrent download key detection install#

Worse, the installer package was pointlessly distributed inside a disk image file.Įxamining this installer revealed that it would install what turned out to be the legitimate Little Snitch installer and uninstaller apps, as well as an executable file named “patch”, into the /Users/Shared/ directory. However, this installer was a simple Apple installer package with a generic icon. To start, the legitimate Little Snitch installer is attractively and professionally packaged, with a well-made custom installer that is properly code signed. InstallationĪnalysis of this installer showed that there was definitely something strange going on.

Mix in key torrent download key detection mac#

In fact, we discovered that not only was it malware, but a new Mac ransomware variant spreading via piracy.

A post offered a torrent download for Little Snitch, and was soon followed by a number of comments that the download included malware. The new name, ThiefQuest, is also more fitting for our updated understanding of the malware.Ī Twitter user going by the handle messaged me yesterday after learning of an apparently malicious Little Snitch installer available for download on a Russian forum dedicated to sharing torrent links. Editor’s note: The original name for the malware, EvilQuest, has been changed due to a legitimate game of the same name from 2012.