{"id":2248,"date":"2020-07-13T10:36:51","date_gmt":"2020-07-13T06:06:51","guid":{"rendered":"http:\/\/soroosheamniyat.ir\/?p=2248"},"modified":"2020-12-01T21:19:14","modified_gmt":"2020-12-01T17:49:14","slug":"%db%8c%da%a9-%d8%a8%d8%a7%d8%ac%da%af%db%8c%d8%b1%d8%a7%d9%81%d8%b2%d8%a7%d8%b1-%d8%ac%d8%af%db%8c%d8%af-%d8%a8%d9%87-%d9%86%d8%a7%d9%85-evilquest-%da%a9%d8%a7%d8%b1%d8%a8%d8%b1%d8%a7%d9%86-apple-maco","status":"publish","type":"post","link":"https:\/\/soroosheamniyat.ir\/?p=2248","title":{"rendered":"\u06cc\u06a9 \u0628\u0627\u062c\u06af\u06cc\u0631\u0627\u0641\u0632\u0627\u0631 \u062c\u062f\u06cc\u062f \u0628\u0647 \u0646\u0627\u0645 EvilQuest \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 Apple macOS \u0631\u0627 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc Pirate \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f."},"content":{"rendered":"

?????? ????? ?????? ??? ????? ?? ????????????? (EvilQuest) ?? ??? ????? ?? ??????? macOS ?? ??? ???? ???? ??? ?? ?? ???? ?????????? Pirate ??? ??????.<\/p>\n

?? ???? ????? ????? ????? ?? ??? ???? ???????K7 Lab \u00a0???? Dinesh Devadoss ?Patrick Wardle ? Malwarebytes? ??? ??? ??????????? ?? ????? EvilQuest ????? ?? ?????????? ????? ????????? ??? ??? ?? ?? ?? ???? ??? ?? ?? ????? Apple CrashReporter ?? Google Software Update ????? ??????[?-?]<\/a>.<\/p>\n

????? ?? ???????? ???????? ??????? EvilQuest ?????? ????? ???????? ???? ??????? ?? ?????? ??? ???? ??????? ?????????? ???? ?? ?????? ????? ?? shell ????? ? ???? ???????? ????? ?? ??? ??? ?????? ??????? ???.<\/p>\n

?? ??? ??????? EvilQuest ?? ????? ??? ?? ????????????? ????????? ?? ?????? ??????? ??????? macOS ?? ??? ???? ????????[???]<\/a>? ?????? KeRanger ? Patcher.<\/p>\n

?? ??? ?????? ???? ??? ??????? ???????? ?????? ????? ???????????? ????? macOS ????? Little Snitch? ?? ????????? DJ ?? ??? Mixed In Key 8 ? Ableton Live ??? ?? ?? ???????? ????? ????? ????? ???????.<\/p>\n

Thomas Reed? ???? Mac ? ?????? ?? Malwarebytes ???: \u201c?? ??????installer\u00a0 ?????? Little Snitch ??????? ?????? ? ??????? ????????? ??? ??? ?? ????? ?? ??installer\u00a0 ?????? ???????? ?????? ???? ???? ??? ???. ?????????? ???installer\u00a0 ?? ?????? installer ?????? ??? ?? ?? ????? ????? ???. ???? ?????? ??? ?????? installer ???? ??? ?? ?? ???? disk image ????? ??? ???.\u201d<\/p>\n

\"\"<\/p>\n

EvilQuest ?? ?? ??? ??? ?????? ?????? ?? ????? sandbox ?? ???? ??????? sleep-patching ????? ??????[?]<\/a>\u00a0? ?? ???? anti-debugging ???? ??? ??? ?? ??????? ???? ??? ?? ??? ???????? ??????? ??? ?? debugger ?? ??? ???? ????.<\/p>\n

Reed ???: \u201c???? ????????? ????? ????? ???????? ????. ?????????????? ????? ??????????? ????????? ???? MacOS ???? KeRanger ???? ?? ??? ????? ??? ????? ???? ????? ? ???? ?? ???????? ??????? ???. ??? ????? ?? ????? ???? ???? ???? ??? ??????? ???? ???? ??? ??? ????? ???? ???????? ?? ???????? ??????? ?? ?? ??? ??? ????? ????.\u201d<\/p>\n

\"\"<\/p>\n

??? ??????????? ?????? ?????? ????????? ?????? (????? Kaspersky ? Norton ? Avast ? DrWeb ? McAfee ? Bitdefender ? Bullguard) ?? ?? ???? ??? ???? ???????? ????? ?? ??? ????? ????? ???? ?? ????? ????? ?? ??? ?????? ? ?? ??????? ?? ???????? ???? ?????????? ? daemon property list ????? com.apple.questd.plist ??????? ??? ?? ????? ??????[?]<\/a> ? ?? ??? ?? ????? ???? ????? ???? ??????? ?????? ?????? ?? ????? ?????????? ??????.<\/p>\n

?? ????? ?????? EvilQuest ??????? ?? ??? ?? ?????????? ?????? ? ???? ?? ???????? ???????? ????? ??? ??? ?????? ??????? (\u201cwallet.pdf\u201d) ? ???????? ????? ?? keychain ??????? ??? ?? ????? ??????? ?????????? ????? ?? ????????? ???? ??????? ?? ???? ?? ?? ???? ?? ??????? ??? ????? ??????? ????? ???? ???.<\/p>\n

??? ????????? EvilQuest ????? ?? ?? ??????????? ?????? ???? ?????? ????? ??????? ?????? ?? ???? ????? ? ????? (\u201candrewka6.pythonanywhere.com\u201d) ???? ????? ??????? ?? ??? ???? ?????????? keylogger? ????? ?? shell ????? ? ??? ????? ?? payload ???? ?????? ?????? ???? ?? ?????.<\/p>\n

Wardle ?? ??? ???? ???????: \u201c?? ????? ???? ?? ??? ????????? ???????? ????? ???? ??? ?? ?????? ????? ?? ?? ??? ????.\u201d<\/p>\n

????????? ??? ???? ????? ?? ??? ?? ???????? ???????? ??? ??????????? ???? ????? ?? ????????? ???????? ??????? ???? ??? ????? ?????? ??????? macOS ???? ??????? ?? ??? ???? ???????? ?? ???????? ??? ??????? ???? ???? ? ???? ???? ???? ???? ?????? ?? ?????? ????? RansomWhere ??????? ????[?]<\/a>.<\/p>\n

Reed ?????????? ??? ??: \u201c?????? ??? ???? ??????? ?? ???????? ??? ??????????? ??? ??? ?? ?? ??????????? ?????? ??????? ???? ????. ????? ?? ???? ??????? ?? ???? ???????? ??? ?? ??? ????? ? ????? ??? ?? ?????????? ????? ?? ????? Mac ??? ????? ???.\u201d<\/p>\n

???????:<\/p>\n

??????????<\/p>\n

?????<\/strong><\/p>\n

<\/a>[?]<\/a> https:\/\/twitter.com\/dineshdina04\/status\/1277668001538433025<\/a><\/p>\n

[?]<\/a> https:\/\/objective-see.com\/blog\/blog_0x59.html<\/a><\/p>\n

[?]<\/a> https:\/\/blog.malwarebytes.com\/mac\/2020\/06\/new-mac-ransomware-spreading-through-piracy\/<\/a><\/p>\n

<\/a>[?]<\/a>https:\/\/unit42.paloaltonetworks.com\/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer<\/a><\/p>\n

<\/a><\/a>[?]<\/a><\/a> https:\/\/www.welivesecurity.com\/2017\/02\/22\/new-crypto-ransomware-hits-macos<\/a><\/p>\n

[?]<\/a>https:\/\/www.isaca.org\/resources\/isaca-journal\/issues\/2017\/volume-6\/evasive-malware-tricks-how-malware-evades-detection-by-sandboxes<\/a><\/p>\n

[?]<\/a> https:\/\/en.wikipedia.org\/wiki\/Property_list<\/a><\/p>\n

[?]<\/a> https:\/\/objective-see.com\/products\/ransomwhere.html<\/a><\/p>\n

<\/a><\/p>\n

[?] https:\/\/thehackernews.com\/2020\/07\/macos-ransomware-attack.html<\/a><\/p>\n