Techsurvivors
Welcome to Techsurvivors => Tech => Topic started by: krissel on February 22, 2021, 05:33:16 AM
-
The latest on the malware:
https://www.cnn.com/2021/02/21/tech/mac-mysterious-malware/index.html (https://www.cnn.com/2021/02/21/tech/mac-mysterious-malware/index.html)
https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/ (https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/)
From the comments:
"For those wondering, from the external blog post there are two scripts written to disk that should indicate if you have it, the locations are: /tmp/agent.sh and ~/Library/Application Support/verx_updater/verx.sh"
-
Thanks, Kriss. I didn't read the Ars article before checking my 'old' iNtel macs. They are all clean, of course.
However, there is a reader post at the end of that article with some additional files to look for. It has 340+ upvotes but that may not be enough to vouch for its credibility. There may even be some later posts negating the file's involvement. :dntknw: Still, looking for file names is extremely easy. :yes:
- ~/Library/._insu (empty file used to signal the malware to delete itself)
- /tmp/agent.sh (shell script executed for installation callback)
- /tmp/version.json (file downloaded from from S3 to determine execution flow)
- /tmp/version.plist (version.json converted into a property list)
-
Still, looking for file names is extremely easy. :yes:
I admit that I had to research how to search for these files, and it's harder on my laptop as I don't have the 2nd library unhidden. It might be good, since you're way better at this than I am, if you gave some instructions for those of us who are confused. ;)
-
First, remember that Apple has redefined what was originally called “Finder”. It no longer does what it’s name implies. :wallbash:
Second, you can still ‘force’ Finder to display your own Library directory in the Finder Sidebar, like anything else you’d want to put there. Use the Finder->Go menu (one last time!) to select “Library” or just type shift-command-L. You should now see the contents of your (user) Library (“~/Library”). You can select and Drag that label into the Finder Sidebar. It will remain there until you change it or Apple decides what is better for us. :coolio:
NOTE: Be sure to check/enable “Show all file am extensions” in Finder Pref->Advanced tab.
To see the “temp”, “var”, etc directories, just select the standard Apple hard drive volume in the Finder Sidebar. I think in Finder it is a “Locations” section of that Sidebar. :Thinking:
Finally, I highly recommend Pathfinder and just keep Finder hidden. :yes:
-
Just to be clear, this malware is written in two versions, one for Intel Macs and one for M1 Macs. The newer Macs are targeted as well as older ones.
<_<
-
Apple has taken steps to eradicate mysterious malware strain (https://appleinsider.com/articles/21/02/22/apple-has-taken-steps-to-eradicate-mysterious-malware-strain)