Silver sparrow

[krissel]

The latest on the malware:


https://www.cnn.com/2021/02/21/tech/mac-mysterious-malware/index.html


https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/


From the comments:


"For those wondering, from the external blog post there are two scripts written to disk that should indicate if you have it, the locations are: /tmp/agent.sh and ~/Library/Application Support/verx_updater/verx.sh"

[Xairbusdriver]

Thanks, Kriss. I didn't read the Ars article before checking my 'old' iNtel macs. They are all clean, of course.

However, there is a reader post at the end of that article with some additional files to look for. It has 340+ upvotes but that may not be enough to vouch for its credibility. There may even be some later posts negating the file's involvement. Still, looking for file names is extremely easy.

• ~/Library/._insu (empty file used to signal the malware to delete itself)
• /tmp/agent.sh (shell script executed for installation callback)
• /tmp/version.json (file downloaded from from S3 to determine execution flow)
• /tmp/version.plist (version.json converted into a property list)

[kimmer]

Still, looking for file names is extremely easy.

I admit that I had to research how to search for these files, and it's harder on my laptop as I don't have the 2nd library unhidden. It might be good, since you're way better at this than I am, if you gave some instructions for those of us who are confused.

[Xairbusdriver]

First, remember that Apple has redefined what was originally called “Finder”. It no longer does what it’s name implies.

Second, you can still ‘force’ Finder to display your own Library directory in the Finder Sidebar, like anything else you’d want to put there. Use the Finder->Go menu (one last time!) to select “Library” or just type shift-command-L. You should now see the contents of your (user) Library (“~/Library”). You can select and Drag that label into the Finder Sidebar. It will remain there until you change it or Apple decides what is better for us.
NOTE: Be sure to check/enable “Show all file am extensions” in Finder Pref->Advanced tab.

To see the “temp”, “var”, etc directories, just select the standard Apple hard drive volume in the Finder Sidebar. I think in Finder it is a “Locations” section of that Sidebar.

Finally, I highly recommend Pathfinder and just keep Finder hidden.

[krissel]

Just to be clear, this malware is written in two versions, one for Intel Macs and one for M1 Macs.  The newer Macs are targeted as well as older ones.
 

[jchuzi]

Apple has taken steps to eradicate mysterious malware strain