Then the ransomware generates a random 25-character string to use as the key to encrypt the files. Its content is shown later in the article. It copies a file called README!.txt all around the user’s directories such as “Documents” and “Photos”. Sealed Resources version=2 rules=12 files=14įigure 3 – The main window of the ransomware File encryption processĬlicking the start button – shown in Figure 3 – launches the encryption process. $ codesign -dv "Office 2016 Patcher.app"Įxecutable=Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcherįormat=app bundle with Mach-O thin (x86_64)ĬodeDirectory v=20100 size=507 flags=0x2(adhoc) hashes=11+3 location=embedded The application has the bundle identifier NULL.prova and is signed with a key that has not been signed by Apple. The window has a transparent background, which can be quite distracting or confusing (see Figure3), and it’s impossible to reopen the window if it is closed. The application is generally poorly coded. Mind you, our search was not exhaustive there might be more out there.įigure 2 – Icons of the “Patchers” as seen in Finder
ESET FOR MAC TORRENT PRO
We saw two different fake application “Patchers”: one for Adobe Premiere Pro and one for Microsoft Office for Mac.
ESET FOR MAC TORRENT ZIP FILE
The Torrent contains a single ZIP file – an application bundle. Distributionįigure 1 – BitTorrent site distributing Torrent files containing OSX/Filecoder.E This new ransomware, written in Swift, is distributed via BitTorrent distribution sites and calls itself “Patcher”, ostensibly an application for pirating popular software. While most of it targets the Windows desktop, we’ve also seen machines running Linux or macOS being compromised by ransomware in 2016 with, for example, KillDisk affecting Linux and KeRanger attacking OS X.Įarly last week, we have seen a new ransomware campaign for Mac. Crypto-ransomware has been very popular lately amongst cybercriminals.
0 kommentar(er)
