Two days ago, wereportedA foreign security company has discovered a harmful software “ThiefQuest” targeting MacOS that combines ransomware and spyware. It has also shattered the superstition that MacOS is indestructible. Although the infection situation of this virus has not yet expanded, security companies have taken precautions and released free unlocking applications to help infected users recover locked files.
Security company releases free unlocking tool for MacOS ransomware ThiefQuest. Be sure to clean the system again after unlocking
If you regard “ThiefQuest” as a ransomware virus, then you should underestimate it. This virus is composed of a series of codes. In addition to performing the encryption and locking of files by general ransomware viruses, it can also install backdoors in computer systems, monitor users’ keyboard usage, and steal personal information and virtual currency data. It can be said to be a chain plan for users. This virus has been hidden in sharing software on portals and online forums and spread.
Since early June, users infected with ThiefQuest have had their files permanently locked, with no way to unlock them even if they pay the required ransom. Cybersecurity company SentinelOne released a free decryption app today. Security personnel said that although ThiefQuest will encrypt the computer immediately after infecting the macOS system, the malware does not have a mechanism to track the ransom payment status of the user, nor does it provide a contact method. Therefore, as can be seen from the record below, the user must contact the ThiefQuest team to obtain relevant unlocking information.
In a technical article published earlier today, researchers noted that ThiefQuest uses a simple symmetric key encryption system based on the RC2 algorithm, with the ransomware storing encryption and decryption keys in each locked file. The ThiefQuest unlocking tool provided by SentinelOne extracts the decryption key from each file. It is currently provided in binary form, but the company said it plans to open the code in the future. Decryption tools can directlyDownload from this link, or via SentinelOne Download link at the bottom of the technical report. If there are tutorials that need to be unlocked, you canClick here to view the demonstration video。
but,New report from MalwarebytesChuya warns users that in addition to encrypting files, ThiefQuest also infects other native files with virus-like behavior, so it is necessary for users to perform additional cleanup work after unlocking to prevent reinfection or infection of other Mac systems in the future.
◎Data source:ZDNet、Malwarebytes、SentinelOne
Source: KOCPC Chinese