Pirated Mac Applications Could Contain ThiefQuest Ransomware

If you have one or more illegal copies of Apple software on your Mac, be aware that there’s a new threat to be concerned about.

An info-stealing, data wiping malware strain known as ThiefQuest has been found embedded in torrents of illicit software written for macOS.

While ThiefQuest isn’t as commonly seen as some other macOS malware like FileCoder, Patcher or KeRanger, it’s still common enough to stay on the alert for. That’s especially if you use any of the popular torrent sites to grab copies of your favorite software.

The malware strain was first spotted in the wild by Dinesh Devadoss, a security research for K7 Lab. It was analyzed by Thomas Reed, the Director of Mac and Mobile Services for Malwarebytes, legendary researcher Patrick Wardle, and Bleeping Computer’s Lawrence Abrams.

Based on the findings of these researchers, here’s what we know about ThiefQuest:

• It has some advanced anti-detection capabilities, including the ability to check to see if it’s running on a virtual machine, and if so, it will terminate to avoid detection.
• It installs a keylogger and opens a reverse shell on the infected machine,
• It has the ability to check for some of the more commonly used security tools and antimalware solutions, including Kaspersky, Norton, McAffee, Bitdefender, Bullguard, DrWeb, and Avast)

“Armed with these capabilities, the attacker can maintain full control over an infected host” Patrick Wardle noted.

Curiously, ThiefQuest seems almost picky in terms of what files it encrypts. There doesn’t appear to be a readily definable pattern, and this can cause a variety of issues on infected systems.

In any event, once it finishes encrypting whatever files it has selected, it will generate a text file named “READ_ME_NOW.txt” that includes ransom instructions. Victims are currently being asked to pay a $50 ransom in Bitcoin within 72 hours of the message being generated, which is a quite modest sum by modern ransomware standards.

Wardle and the other researchers note, however, that it could increase at any time. Beware of ThiefQuest. Although not the most dangerous malware strain out there, it’s certainly a legitimate threat.