یک باجگیرافزار جدید به نام EvilQuest کاربران Apple macOS را از طریق برنامه‌های Pirate هدف قرار داد.

?????? ????? ?????? ??? ????? ?? ????????????? (EvilQuest) ?? ??? ????? ?? ??????? macOS ?? ??? ???? ???? ??? ?? ?? ???? ?????????? Pirate ??? ??????.

?? ???? ????? ????? ????? ?? ??? ???? ???????K7 Lab  ???? Dinesh Devadoss ?Patrick Wardle ? Malwarebytes? ??? ??? ??????????? ?? ????? EvilQuest ????? ?? ?????????? ????? ????????? ??? ??? ?? ?? ?? ???? ??? ?? ?? ????? Apple CrashReporter ?? Google Software Update ????? ??????[?-?].

????? ?? ???????? ???????? ??????? EvilQuest ?????? ????? ???????? ???? ??????? ?? ?????? ??? ???? ??????? ?????????? ???? ?? ?????? ????? ?? shell ????? ? ???? ???????? ????? ?? ??? ??? ?????? ??????? ???.

?? ??? ??????? EvilQuest ?? ????? ??? ?? ????????????? ????????? ?? ?????? ??????? ??????? macOS ?? ??? ???? ????????[???]? ?????? KeRanger ? Patcher.

?? ??? ?????? ???? ??? ??????? ???????? ?????? ????? ???????????? ????? macOS ????? Little Snitch? ?? ????????? DJ ?? ??? Mixed In Key 8 ? Ableton Live ??? ?? ?? ???????? ????? ????? ????? ???????.

Thomas Reed? ???? Mac ? ?????? ?? Malwarebytes ???: “?? ??????installer  ?????? Little Snitch ??????? ?????? ? ??????? ????????? ??? ??? ?? ????? ?? ??installer  ?????? ???????? ?????? ???? ???? ??? ???. ?????????? ???installer  ?? ?????? installer ?????? ??? ?? ?? ????? ????? ???. ???? ?????? ??? ?????? installer ???? ??? ?? ?? ???? disk image ????? ??? ???.”

EvilQuest ?? ?? ??? ??? ?????? ?????? ?? ????? sandbox ?? ???? ??????? sleep-patching ????? ??????[?] ? ?? ???? anti-debugging ???? ??? ??? ?? ??????? ???? ??? ?? ??? ???????? ??????? ??? ?? debugger ?? ??? ???? ????.

Reed ???: “???? ????????? ????? ????? ???????? ????. ?????????????? ????? ??????????? ????????? ???? MacOS ???? KeRanger ???? ?? ??? ????? ??? ????? ???? ????? ? ???? ?? ???????? ??????? ???. ??? ????? ?? ????? ???? ???? ???? ??? ??????? ???? ???? ??? ??? ????? ???? ???????? ?? ???????? ??????? ?? ?? ??? ??? ????? ????.”

??? ??????????? ?????? ?????? ????????? ?????? (????? Kaspersky ? Norton ? Avast ? DrWeb ? McAfee ? Bitdefender ? Bullguard) ?? ?? ???? ??? ???? ???????? ????? ?? ??? ????? ????? ???? ?? ????? ????? ?? ??? ?????? ? ?? ??????? ?? ???????? ???? ?????????? ? daemon property list ????? com.apple.questd.plist ??????? ??? ?? ????? ??????[?] ? ?? ??? ?? ????? ???? ????? ???? ??????? ?????? ?????? ?? ????? ?????????? ??????.

?? ????? ?????? EvilQuest ??????? ?? ??? ?? ?????????? ?????? ? ???? ?? ???????? ???????? ????? ??? ??? ?????? ??????? (“wallet.pdf”) ? ???????? ????? ?? keychain ??????? ??? ?? ????? ??????? ?????????? ????? ?? ????????? ???? ??????? ?? ???? ?? ?? ???? ?? ??????? ??? ????? ??????? ????? ???? ???.

??? ????????? EvilQuest ????? ?? ?? ??????????? ?????? ???? ?????? ????? ??????? ?????? ?? ???? ????? ? ????? (“andrewka6.pythonanywhere.com”) ???? ????? ??????? ?? ??? ???? ?????????? keylogger? ????? ?? shell ????? ? ??? ????? ?? payload ???? ?????? ?????? ???? ?? ?????.

Wardle ?? ??? ???? ???????: “?? ????? ???? ?? ??? ????????? ???????? ????? ???? ??? ?? ?????? ????? ?? ?? ??? ????.”

????????? ??? ???? ????? ?? ??? ?? ???????? ???????? ??? ??????????? ???? ????? ?? ????????? ???????? ??????? ???? ??? ????? ?????? ??????? macOS ???? ??????? ?? ??? ???? ???????? ?? ???????? ??? ??????? ???? ???? ? ???? ???? ???? ???? ?????? ?? ?????? ????? RansomWhere ??????? ????[?].

Reed ?????????? ??? ??: “?????? ??? ???? ??????? ?? ???????? ??? ??????????? ??? ??? ?? ?? ??????????? ?????? ??????? ???? ????. ????? ?? ???? ??????? ?? ???? ???????? ??? ?? ??? ????? ? ????? ??? ?? ?????????? ????? ?? ????? Mac ??? ????? ???.”

???????:

??????????

?????

[?] https://twitter.com/dineshdina04/status/1277668001538433025

[?] https://objective-see.com/blog/blog_0x59.html

[?] https://blog.malwarebytes.com/mac/2020/06/new-mac-ransomware-spreading-through-piracy/

[?]https://unit42.paloaltonetworks.com/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer

[?] https://www.welivesecurity.com/2017/02/22/new-crypto-ransomware-hits-macos

[?]https://www.isaca.org/resources/isaca-journal/issues/2017/volume-6/evasive-malware-tricks-how-malware-evades-detection-by-sandboxes

[?] https://en.wikipedia.org/wiki/Property_list

[?] https://objective-see.com/products/ransomwhere.html

[?] https://thehackernews.com/2020/07/macos-ransomware-attack.html

پویش #دو_درجه_کمتر