Skip to main content

Pirated Mac Applications Could Contain ThiefQuest Ransomware

By July 15, 2020May 5th, 2022Cybersecurity

If you have one or more illegal copies of Apple software on your Mac, be aware that there’s a new threat to be concerned about.

An info-stealing, data wiping malware strain known as ThiefQuest has been found embedded in torrents of illicit software written for macOS.

While ThiefQuest isn’t as commonly seen as some other macOS malware like FileCoder, Patcher or KeRanger, it’s still common enough to stay on the alert for. That’s especially if you use any of the popular torrent sites to grab copies of your favorite software.

The malware strain was first spotted in the wild by Dinesh Devadoss, a security research for K7 Lab. It was analyzed by Thomas Reed, the Director of Mac and Mobile Services for Malwarebytes, legendary researcher Patrick Wardle, and Bleeping Computer’s Lawrence Abrams.

Based on the findings of these researchers, here’s what we know about ThiefQuest:

  • It has some advanced anti-detection capabilities, including the ability to check to see if it’s running on a virtual machine, and if so, it will terminate to avoid detection.
  • It installs a keylogger and opens a reverse shell on the infected machine,
  • It has the ability to check for some of the more commonly used security tools and antimalware solutions, including Kaspersky, Norton, McAffee, Bitdefender, Bullguard, DrWeb, and Avast)

Armed with these capabilities, the attacker can maintain full control over an infected host” Patrick Wardle noted.

Curiously, ThiefQuest seems almost picky in terms of what files it encrypts. There doesn’t appear to be a readily definable pattern, and this can cause a variety of issues on infected systems.

In any event, once it finishes encrypting whatever files it has selected, it will generate a text file named “READ_ME_NOW.txt” that includes ransom instructions. Victims are currently being asked to pay a $50 ransom in Bitcoin within 72 hours of the message being generated, which is a quite modest sum by modern ransomware standards.

Wardle and the other researchers note, however, that it could increase at any time. Beware of ThiefQuest. Although not the most dangerous malware strain out there, it’s certainly a legitimate threat.

Jason Manteiga

Jason J. Manteiga, Vice President of Olmec Systems, has been part of the company for over the past 20 years. He believes that having a great work environment and supportive team, is the ultimate key to success. Since being in the IT realm for over 25 years, Jason, along with Olmec Systems, has been on the Inc. 5000 “List of America’s Fastest Growing Private Companies” and Channel Futures MSP 501 “Top Managed Service Providers in North America,” along with other awards and nominations. Jason earned his Bachelor Degree in Information Systems from the New Jersey Institute of Technology. He also holds certifications in Microsoft MCSE, VMWare VCP, and Cisco CCNA. In his spare time, Jason is a contributor for The Center for Social & Legal Research (Privacy Exchange) and a member of the Morris County Chamber of Commerce. His hobbies include cycling and kayaking. He currently lives in New Jersey with his wife, two daughters and son.