#DATATHIEF ADD HINT CODE#
#DATATHIEF ADD HINT MAC#
#DATATHIEF ADD HINT WINDOWS#

That in itself is odd, since Macs are now widely used in enterprise environments, particularly by C-Suite staff and by developers, both juicy targets for threat actors.

#DATATHIEF ADD HINT WINDOWS#

Ransomware has been pillaging the Windows world of late, but this is only the third known ‘in the wild’ ransomware targeting macOS. “EvilQuest/ThiefQuest” will likely stick simply because of its widespread initial use in the media, and who doesn’t like a thief or a good bit of evil in a headline anyway? Broken Crypto: Ransomware Capabilities, Just for Show?Īs the initial excitement around “EvilQuest/ThiefQuest” stemmed from it being a novel macOS ransomware threat, let’s look at that first. Despite there being a strong argument for calling this new threat “OSX.EffectiveIdiot”, we suspect that this naming muddle is probably a bed that cannot be unmade. While it could be argued that malware naming conventions aren’t vitally important, they are nevertheless helpful, particularly for researchers and others tracking evolving public discussion and research. Moreover, string obfuscation in recent samples shows that the developers deliberately planted the user name “drozdovsky” and the build name ‘toidievitceffe”, no doubt in an attempt to misdirect attribution. Here we use the excellent floss tool to extract strings as an alternative to the native strings utility:

In some samples, the reversed “effectiveidiot” string occurs over 60 times, which might suggest the malware authors themselves were rather fond of the idea that security researchers would hit on this for a name. Other interesting reversed strings here include “naughtycuckoo”, “keylogger” and “filewatcher”, which as we will explain further below may give a better insight into the threat actor’s true motivation. Moreover, we see the developers clearly used “toidievitceffe” as the name of their Xcode project. On that score, the most common characteristic in the samples seen so far is the _cstring literal “toidievitceffe”, which along with other strings like “rennur.c” (c.runner) is clearly the reverse of otherwise recognizable English language words: echo 'toidievitceffe' | rev

#DATATHIEF ADD HINT CODE#

As malware authors on all platforms are increasingly reusing code to provide multiple features, classifying by threat type may not be all that helpful.Ī good malware naming convention would ideally group malware samples by common characteristics. While does conform to a recognized convention (platform/type/variant), it’s problematic because the threat is not only, and perhaps not even primarily, a ransomware threat. This has led to some confusion, unfortunately, both about the threat and its capabilities. Aside from the two names they suggested, many engines on VT also flag it as MacRansom.K. The threat was initially labelled “EvilQuest” by researchers at Malwarebytes, who then re-named it a few days later as “ThiefQuest”.

The Many Names of EvilQuest, ThiefQuest, and MacRansom.K In this post, we’ll cover what is known to date and bring you up-to-speed on the latest iterations.

#DATATHIEF ADD HINT MAC#

As it turns out, this threat is much more than just a novel piece of ransomware, is under active development, and is one of the more complex threats to be seen so far targeting the Mac platform. First brought to the macOS community’s attention by malware researcher Dinesh Devadoss, this threat has been receiving intense scrutiny from security researchers, with some excellent work done by researchers Scott Knight, Patrick Wardle and our own SentinelLabs team. There has, unsurprisingly, been a great deal of interest in the news that a new macOS threat with ransomware capabilities is on the loose.

Datathief add hint